mjolnir-qa 2.0.2 → 2.1.0

package/dist/cli.mjs

@@ -1,21 +1,23 @@
 #!/usr/bin/env node
-import { $ as SCAN_ADAPTERS, A as box, B as headlineFor, C as buildFooter, D as plainContext, E as panel, F as scoreGauge, G as capForTier, H as EVIDENCE, I as shouldColorize, J as massCeiling, K as computeDimensions, L as shouldUseAscii, M as padTo, N as palette, O as sectionHeader, P as sanitizeData, Q as resolveGitPath, R as wrapText, S as FLAKE_GLYPH, St as isValidCategory, T as okIcon, U as TINT, V as BADGE_BAND, W as TRUST, X as RULES, Y as RETIRED_RULE_IDS, Z as getRule, _t as QA_IMPACT_LABELS, at as parseTsFile, b as renderSuppressions, bt as deriveEvidenceLevel, ct as createIgnoreMatcher, dt as loadConfig, et as SEARCHED_FOR, ft as isRecord, gt as DEDUCTIONS, h as scan_pipeline_exports, ht as MEASURED_FP, it as computeCodeText, j as measure, k as severityIcon, lt as isLintFixtureDir, m as runScan$1, mt as ENGINE_VERSION, n as KNOWN_RULE_IDS$1, nt as parseAzurePipeline, ot as detectFrameworks, pt as parseJsonFile, q as deductionFor, rt as parseWorkflow, st as DEFAULT_IGNORE_MATCHER, tt as isAzurePipelineFixture, ut as ConfigValidationError, v as loadLocalRules, vt as RULE_CATEGORIES, w as nextStep, x as runForensics, xt as isAdvisoryFinding, y as loadSuppressions, yt as SEVERITY_ORDER$1, z as deriveScoreState } from "./scan-pipeline-D3Yk2cef.mjs";
+import { $ as massCeiling, A as box, At as isAdvisoryFinding, B as headlineFor, C as buildFooter, Ct as buildEvidenceGraph, D as plainContext, Dt as RULE_CATEGORIES, E as panel, Et as QA_IMPACT_LABELS, F as scoreGauge, G as buildDependencyGraph, H as EVIDENCE, I as shouldColorize, J as classifyProvenance, K as getReachableFiles, L as shouldUseAscii, M as padTo, N as palette, O as sectionHeader, Ot as SEVERITY_ORDER$1, P as sanitizeData, Q as deductionFor, R as wrapText, S as FLAKE_GLYPH, St as ENGINE_VERSION, T as okIcon, Tt as DEDUCTIONS, U as TINT, V as BADGE_BAND, W as TRUST, X as capForTier, Y as computeAgenticProfile, Z as computeDimensions, _t as ConfigValidationError, at as SEARCHED_FOR, b as renderSuppressions, bt as isRecord$2, ct as parseWorkflow, dt as parseTsFile, et as RETIRED_RULE_IDS, ft as detectFrameworks, gt as isLintFixtureDir, h as scan_pipeline_exports, ht as globToRegExp, it as SCAN_ADAPTERS, j as measure, jt as isValidCategory, k as severityIcon, kt as deriveEvidenceLevel, lt as parseYamlGuarded, m as runScan$1, mt as createIgnoreMatcher, n as KNOWN_RULE_IDS$1, nt as getRule, ot as isAzurePipelineFixture, pt as DEFAULT_IGNORE_MATCHER, q as correlateFindings, rt as resolveGitPath, st as parseAzurePipeline, tt as RULES, ut as computeCodeText, v as loadLocalRules, vt as isSuppressionActive, w as nextStep, wt as MEASURED_FP, x as runForensics, xt as parseJsonFile, y as loadSuppressions, yt as loadConfig, z as deriveScoreState } from "./scan-pipeline-MQGUSey3.mjs";
 import { accessSync, appendFileSync, chmodSync, closeSync, constants, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
-import { dirname, join, relative, resolve, sep } from "node:path";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import process$1 from "node:process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createHash, randomBytes } from "node:crypto";
 import ts, { ts as ts$1 } from "ts-morph";
+import { parse } from "yaml";
 import { execFileSync } from "node:child_process";
 import { createInterface } from "node:readline";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { tmpdir } from "node:os";
+import { isDeepStrictEqual } from "node:util";
 //#region src/commands/help.ts
 /** Ordered registry — grouped by the same categories the overview uses. */
 const HELP_ENTRIES = [
 	{
 		verb: "ci install",
-		summary: "generate the PR workflow (action-based by default; scan + annotations + gate)",
+		summary: "generate the PR workflow (advisory by default; action-based; scan + annotations + gate)",
 		usage: "mjolnir ci install [--gate advisory|error|warning] [--no-action] [--force]",
 		examples: [
 			"mjolnir ci install",
@@ -167,6 +169,55 @@ const HELP_ENTRIES = [
 		usage: "mjolnir suppressions",
 		examples: ["mjolnir suppressions"]
 	},
+	{
+		verb: "ci-integrity",
+		summary: "verify CI workflow integrity and suppression governance",
+		usage: "mjolnir ci-integrity [path] [--policy <file>] [--json]",
+		examples: ["mjolnir ci-integrity", "mjolnir ci-integrity . --policy mjolnir.policy.json --json"],
+		next: "mjolnir suppressions"
+	},
+	{
+		verb: "framework-maturity",
+		summary: "track framework maturity levels, especially Playwright F4→F5",
+		usage: "mjolnir framework-maturity [--framework <name>] [--json]",
+		examples: ["mjolnir framework-maturity", "mjolnir framework-maturity --framework playwright"],
+		next: "mjolnir ci-integrity"
+	},
+	{
+		verb: "suppression-gate",
+		summary: "enforce suppression policy governance gate",
+		usage: "mjolnir suppression-gate [path] [--policy <file>] [--json]",
+		examples: ["mjolnir suppression-gate", "mjolnir suppression-gate . --policy mjolnir.policy.json"],
+		next: "mjolnir framework-maturity"
+	},
+	{
+		verb: "cross-file",
+		summary: "analyze cross-file signals: duplicates, shared imports, circular deps",
+		usage: "mjolnir cross-file [path] [--json]",
+		examples: ["mjolnir cross-file", "mjolnir cross-file . --json"],
+		next: "mjolnir suppression-gate"
+	},
+	{
+		verb: "contract-verify",
+		summary: "verify machine contract integrity against scan results",
+		usage: "mjolnir contract-verify [path] [--contract <scan-json>] [--json]",
+		examples: ["mjolnir contract-verify", "mjolnir contract-verify . --contract scan.json --json"],
+		next: "mjolnir cross-file"
+	},
+	{
+		verb: "trust-trend",
+		summary: "track historical trust trends and detect regressions",
+		usage: "mjolnir trust-trend [path] [--history <file>] [--recorded-at <iso>] [--json]",
+		examples: ["mjolnir trust-trend", "mjolnir trust-trend . --history .mjolnir/trust-history.json --json"],
+		next: "mjolnir contract-verify"
+	},
+	{
+		verb: "evidence-graph",
+		summary: "build and query the verification evidence graph",
+		usage: "mjolnir evidence-graph [path] [--file <path>|--rule <id>] [--json]",
+		examples: ["mjolnir evidence-graph", "mjolnir evidence-graph . --rule QA-TEST-001 --json"],
+		next: "mjolnir trust-trend"
+	},
 	{
 		verb: "create-rule",
 		summary: "scaffold a new rule + fixtures (must-fire, must-not-fire)",
@@ -193,7 +244,7 @@ const HELP_ENTRIES = [
 	},
 	{
 		verb: "mcp",
-		summary: "run as an MCP server over stdio (scan / explain / diff / verify tools)",
+		summary: "run as a read-only MCP server over stdio (scan / explain / diff / verify / forensics / triage / pw-report)",
 		usage: "mjolnir mcp",
 		examples: ["mjolnir mcp"]
 	}
@@ -305,8 +356,8 @@ const ROOT_HELP_VERBS = /* @__PURE__ */ new Set([
 	"help"
 ]);
 /** One per-verb help page: summary, usage, examples, next step. */
-function renderVerbHelp(verb) {
-	if (!hasVerbHelp(verb) && ROOT_HELP_VERBS.has(verb)) return renderRootHelp();
+function renderVerbHelp(verb, options = {}) {
+	if (!hasVerbHelp(verb) && ROOT_HELP_VERBS.has(verb)) return renderRootHelp(1, options);
 	const e = findEntry(verb);
 	if (!e) return [
 		`  No detailed help for "${verb}".`,
@@ -348,7 +399,8 @@ const GROUPS = [
 			"impact",
 			"baseline",
 			"diff",
-			"verify"
+			"verify",
+			"ci-integrity"
 		]
 	},
 	{
@@ -375,7 +427,13 @@ const GROUPS = [
 			"init",
 			"doctor",
 			"release-trust",
-			"create-rule"
+			"create-rule",
+			"cross-file",
+			"contract-verify",
+			"trust-trend",
+			"evidence-graph",
+			"framework-maturity",
+			"suppression-gate"
 		]
 	},
 	{
@@ -391,6 +449,58 @@ const GROUPS = [
 	}
 ];
 const SCAN_SUMMARY_LINES = ["mjolnir [path]                 full-repo scan + WORTHINESS score"];
+const DEFAULT_HELP_WIDTH = 88;
+/**
+* Normalizes the terminal width for help rendering. When no width is
+* supplied, falls back to the default help width (88). Clamps to a
+* readable minimum so narrow terminals do not produce unusably short
+* columns.
+*/
+function normalizeHelpWidth(width) {
+	if (width === void 0 || !Number.isFinite(width)) return DEFAULT_HELP_WIDTH;
+	return Math.max(48, Math.floor(width));
+}
+function wrapWords(text, width) {
+	if (text.length <= width) return [text];
+	const words = text.split(/\s+/).filter(Boolean);
+	const lines = [];
+	let current = "";
+	for (const word of words) {
+		if (current.length === 0) {
+			current = word;
+			continue;
+		}
+		if (current.length + 1 + word.length <= width) {
+			current += ` ${word}`;
+			continue;
+		}
+		lines.push(current);
+		current = word;
+	}
+	if (current.length > 0) lines.push(current);
+	return lines.length > 0 ? lines : [text];
+}
+function pushWrappedIndented(lines, text, indent, width) {
+	for (const line of wrapWords(text, Math.max(16, width - indent.length))) lines.push(`${indent}${line}`);
+}
+/**
+* Renders a label-summary row, wrapping the summary across continuation
+* lines when the terminal is narrower than the label + summary.
+*/
+function pushAlignedHelpRow(lines, label, summary, options) {
+	const indent = " ".repeat(options.indent ?? 2);
+	const gap = "  ";
+	const summaryIndent = `${indent}${" ".repeat(options.labelWidth)}${gap}`;
+	const summaryWidth = Math.max(16, options.width - summaryIndent.length);
+	if (label.length <= options.labelWidth) {
+		const summaryLines = wrapWords(summary, summaryWidth);
+		lines.push(`${indent}${label.padEnd(options.labelWidth)}${gap}${summaryLines[0] ?? ""}`);
+		for (const line of summaryLines.slice(1)) lines.push(`${summaryIndent}${line}`);
+		return;
+	}
+	pushWrappedIndented(lines, label, indent, options.width);
+	pushWrappedIndented(lines, summary, `${indent}  `, options.width);
+}
 /**
 * The redesigned root help (plan M2): grouped sections, one-line
 * descriptions, copy-pasteable examples, the frozen exit-code table and
@@ -398,7 +508,8 @@ const SCAN_SUMMARY_LINES = ["mjolnir [path]                 full-repo scan + WOR
 * caller decides (runHelpCommand passes a resolved palette; printUsage
 * stays plain).
 */
-function renderRootHelp(schemaVersion = 1) {
+function renderRootHelp(schemaVersion = 1, options = {}) {
+	const width = normalizeHelpWidth(options.width);
 	const byVerb = new Map(HELP_ENTRIES.map((e) => [e.verb, e]));
 	const lines = [];
 	lines.push("🔨 mjölnir — verification trust engine for test suites and CI pipelines");
@@ -418,20 +529,28 @@ function renderRootHelp(schemaVersion = 1) {
 	lines.push("  mjolnir rules --unmeasured     the rules running on assumption, not measurement");
 	lines.push("");
 	lines.push("Options:");
-	for (const f of HELP_FLAGS) {
-		const pad = f.flag.padEnd(22);
-		lines.push(`  ${pad}${f.summary}`);
-	}
-	lines.push("  -v, --version         print the installed version and exit");
-	lines.push("  -h, --help            show this help");
+	for (const f of HELP_FLAGS) pushAlignedHelpRow(lines, f.flag, f.summary, {
+		width,
+		labelWidth: 22
+	});
+	pushAlignedHelpRow(lines, "-v, --version", "print the installed version and exit", {
+		width,
+		labelWidth: 22
+	});
+	pushAlignedHelpRow(lines, "-h, --help", "show this help", {
+		width,
+		labelWidth: 22
+	});
 	lines.push("");
 	for (const g of GROUPS) {
 		lines.push(`Subcommands — ${g.title}:`);
 		for (const verb of g.verbs) {
 			const e = byVerb.get(verb);
 			if (!e) continue;
-			const usage = e.usage.replace(/^mjolnir /, "").padEnd(46);
-			lines.push(`  ${usage}${e.summary}`);
+			pushAlignedHelpRow(lines, e.usage.replace(/^mjolnir /, ""), e.summary, {
+				width,
+				labelWidth: 46
+			});
 		}
 		lines.push("");
 	}
@@ -1082,6 +1201,8 @@ function renderExplain(result, width = DEFAULT_EXPLAIN_WIDTH) {
 	if (r.languages?.length) lines.push(`Languages:   ${r.languages.join(", ")}`);
 	if (r.frameworks?.length) lines.push(`Frameworks:  ${r.frameworks.join(", ")}`);
 	lines.push("");
+	appendReviewComment(lines, r, result, evidenceLevel, width);
+	lines.push("");
 	if (result.exampleFinding) {
 		const f = result.exampleFinding;
 		lines.push("WHAT WAS FOUND (real detector output, not a mockup)");
@@ -1109,6 +1230,54 @@ function renderExplain(result, width = DEFAULT_EXPLAIN_WIDTH) {
 	return lines.join("\n");
 }
 /**
+* Renders the copy-ready review-comment block. Quarantine-tier findings
+* are advisory (E0, never gate CI — see whatWouldChangeTheVerdict), so
+* their lead-in must not read as a merge blocker; every other tier keeps
+* the blocking wording. The finding's own severity is NOT consulted
+* here — only the rule's tier, because the gate policy is tier-driven,
+* not severity-driven (a quarantine rule may carry error severity and
+* still never block).
+*/
+function appendReviewComment(lines, rule, result, evidenceLevel, width) {
+	const measured = MEASURED_FP[rule.id];
+	const finding = result.exampleFinding;
+	const pushBody = (text) => {
+		for (const seg of wrapText(text, Math.max(20, width - 2))) lines.push(`  ${seg}`);
+	};
+	const fpStatus = measured !== void 0 ? `measured FP ${Math.round(measured.fpRate * 100)}% (${measured.n} verdicts)` : "measured FP not available yet; treat as rule-author assumption";
+	const isQuarantine = effectiveTier(rule) === "quarantine";
+	lines.push("COPY-READY REVIEW COMMENT");
+	pushBody(isQuarantine ? `Advisory finding — this does not block merging: ${reviewSentence(finding?.message ?? rule.title)}.` : `Please fix this before merging: ${reviewSentence(finding?.message ?? rule.title)}.`);
+	pushBody(`Why it weakens verification: ${reviewSentence(finding?.why ?? QA_IMPACT_LABELS[rule.qaImpact])}.`);
+	pushBody(`Confidence: ${rule.confidence}, evidence ${evidenceLevel}, tier ${effectiveTier(rule)}${isProvisional(rule) ? " (PROVISIONAL)" : ""}; ${fpStatus}.`);
+	pushBody(`Suggested fix: ${reviewSentence(finding?.fix ?? defaultFixGuidance(rule, finding === void 0))}.`);
+	pushBody(`Verify with: mjolnir --scope changed, then mjolnir explain ${rule.id} if the finding still appears.`);
+}
+/**
+* Honest fallback for the "Suggested fix" line when the rule produced no
+* real example finding. There is no `fix` field on RuleMeta — the
+* guidance above is always derived from a real detector output, so when
+* that is absent there is nothing to quote. Claiming otherwise ("apply
+* the rule guidance above") pointed at a section that did not exist.
+*
+* Quarantine rules additionally have no merge-blocking fix to suggest;
+* the honest move is to name the tier and point at the catalog.
+*/
+function defaultFixGuidance(rule, noExample) {
+	if (noExample) return `fixture-derived guidance is unavailable for ${rule.id} — run this command from a mjolnir checkout (or pass --fixtures-root) so the rule's own must-fire fixture can be shown, or browse the full catalog with \`mjolnir rules --md\`.`;
+	return `apply the rule guidance above (tier ${effectiveTier(rule)})`;
+}
+/**
+* Strips a trailing run of sentence-ending punctuation from a finding
+* field so the review comment reads as one clause rather than a
+* fragment followed by a period. Trims whitespace first so a field like
+* "fix the thing." becomes "fix the thing" and the renderer's own period
+* is the only one.
+*/
+function reviewSentence(text) {
+	return text.trim().replace(/[.。]+$/u, "");
+}
+/**
 * WHAT WOULD CHANGE THE VERDICT for a rule-level explanation (plan §26
 * WI-7, §8): the honest list of state changes that move this rule's
 * findings on the trust ladder or the census. Deterministic, derived
@@ -1125,11 +1294,17 @@ function whatWouldChangeTheVerdict(r) {
 /** Structural validation of the loaded JSON (hostile-input safe). */
 function parseScanJson(raw) {
 	try {
-		return parseJsonFile(raw, "scan result", (v) => isRecord(v) && v.schemaVersion === 1 && Array.isArray(v.findings) && Boolean(v.analysisStatus) && typeof v.partial === "boolean");
+		return parseJsonFile(raw, "scan result", (v) => isRecord$2(v) && v.schemaVersion === 1 && Array.isArray(v.findings) && Boolean(v.analysisStatus) && typeof v.partial === "boolean");
 	} catch {
 		return;
 	}
 }
+/**
+* Loads a canonical scan result from a JSON file for verdict-mode
+* explain (`mjolnir explain <scan-result.json>`). The file is treated
+* as hostile input: parse failure or schema mismatch returns ok:false
+* with a message naming the contract, never a thrown exception.
+*/
 function explainVerdict(jsonPath) {
 	let raw;
 	try {
@@ -1182,6 +1357,13 @@ function verdictWhatWouldChange(scan) {
 	changes.push("fixing the top trust risks (mjolnir explain <RULE-ID>) moves the score and the verdict band");
 	return changes;
 }
+/**
+* Renders the verdict-mode explanation (`mjolnir explain <scan-result.json>`):
+* the saved scan's score, trust level, evidence checklist, correlation,
+* ceiling reasons, and the honest list of what would change the verdict.
+* Every line is derived from the parsed scan — nothing is invented, and
+* a missing trust summary renders as L0 rather than a fabricated score.
+*/
 function renderVerdictExplain(result, width = DEFAULT_EXPLAIN_WIDTH) {
 	if (!result.ok || !result.scan) return `explain failed: ${result.error ?? "unknown error"}`;
 	const scan = result.scan;
@@ -1218,10 +1400,11 @@ function renderVerdictExplain(result, width = DEFAULT_EXPLAIN_WIDTH) {
 	for (const c of verdictWhatWouldChange(scan)) pushBody(`- ${c}`);
 	lines.push("");
 	lines.push("NEXT ACTION");
-	pushBody(scan.partial ? "re-run with a higher --max-duration to close the truncated surface" : errors > 0 ? "mjolnir triage <test-results-dir-or-report> — then fix the top trust risk" : "keep the gate green (mjolnir ci install)");
+	pushBody(scan.partial ? "re-run with a higher --max-duration to close the truncated surface" : errors > 0 ? "mjolnir triage <test-results-dir-or-report> — then fix the top trust risk" : "no findings on the analyzed surface — install advisory CI and re-scan the changed scope");
 	lines.push("");
 	return lines.join("\n");
 }
+/** Formats a trust-summary ratio (0–1) as a whole-percentage string. */
 function pctOf(v) {
 	return `${Math.round(v * 100)}%`;
 }
@@ -2806,6 +2989,7 @@ const GROUP_THRESHOLD = 3;
 /** Reflow floor: below this, box wrapping targets a minimum readable
 * width rather than shrinking further (an 8-column box is useless). */
 const MIN_BOX_WIDTH = 20;
+/** Renders a scan as a compact terminal report, prioritizing actionable fixes before diagnostics. */
 function renderTerminal(result, opts) {
 	const p = palette(shouldColorize(opts.isTTY));
 	const width = Math.max(MIN_BOX_WIDTH, opts.width ?? process.stdout.columns ?? 80);
@@ -2830,8 +3014,6 @@ function renderTerminal(result, opts) {
 		lines.push(ui.p.dim(`  staged surface: ${result.staged.files} file(s) scanned; score reflects that surface`));
 		lines.push("");
 	}
-	appendDimensions(lines, result, ui);
-	appendDeductions(lines, result, counts, ui);
 	const filtered = opts.visibleFindings;
 	const filtering = filtered !== void 0 && filtered.length < result.findings.length;
 	const display = filtering ? {
@@ -2839,12 +3021,16 @@ function renderTerminal(result, opts) {
 		findings: filtered
 	} : result;
 	appendFixThisFirst(lines, display, ui);
+	appendDimensions(lines, result, ui);
+	appendDeductions(lines, result, counts, ui);
 	if (filtering) {
 		lines.push(ui.p.dim(`  filtered view: ${filtered?.length} of ${result.findings.length} findings shown; score reflects the full scan`));
 		lines.push("");
 	}
 	appendFindings(lines, display, counts, opts.verbose === true, ui, opts.tone);
-	if (counts.total === 0 && result.score === 100) appendForgedBlock(lines, p, ascii);
+	if (counts.total === 0 && result.score === 100 && !result.partial) appendForgedBlock(lines, ui);
+	else if (counts.total === 0 && result.score === 100 && result.partial) appendPartialCleanGuidance(lines, ui);
+	appendNextActions(lines, display, result, ui);
 	appendFooter(lines, result, ui);
 	return lines.join("\n");
 }
@@ -2858,6 +3044,7 @@ function verdictFor(score) {
 	const verdict = deriveScoreState(score).verdict;
 	return verdict === "FORGED" ? "WORTHY" : verdict;
 }
+/** Appends the score, gauge, verdict, and honesty metadata for the full scan. */
 function appendScoreSection(lines, result, p, width, ascii) {
 	const state = deriveScoreState(result.score);
 	const verdictColored = colorizeVerdict(verdictFor(result.score), state.band, p);
@@ -2866,7 +3053,8 @@ function appendScoreSection(lines, result, p, width, ascii) {
 	lines.push(`  ${p.bold("WORTHINESS")} ${p.bold(scoreText)}${p.dim("/100")}  ${verdictColored}`);
 	const gaugeWidth = Math.max(10, Math.min(30, width - 4));
 	lines.push(`  ${scoreGauge(result.score, p, gaugeWidth, ascii)}`);
-	lines.push(`  ${p.dim(headlineFor(state, result.findings.length))}`);
+	const headline = result.partial ? "Partial scan — findings reflect analyzed surface only." : headlineFor(state, result.findings.length);
+	lines.push(`  ${p.dim(headline)}`);
 	if (result.rawDeductions !== void 0 && result.testDeclarationCount) lines.push(`  ${p.dim(`(${result.rawDeductions} raw pts / ${result.testDeclarationCount} test declarations — normalized)`)}`);
 	if (result.effectiveDeductions !== void 0 && result.score !== null) {
 		const ceiling = massCeiling(result.effectiveDeductions);
@@ -2941,10 +3129,20 @@ function appendDeductions(lines, result, counts, ui) {
 	for (const row of panel(rows, ui)) lines.push(row);
 	lines.push("");
 }
+/** Prepends up to three highest-gain fixes with rationale and a concrete next command. */
 function appendFixThisFirst(lines, result, ui) {
 	const fixes = topFixes(result.findings, 3);
-	if (fixes.length === 0) return;
+	if (fixes.length === 0 && result.findings.length === 0) return;
 	lines.push(sectionHeader("FIX THIS FIRST", ui));
+	pushWrapped(lines, ui.p, fixFirstWhy(result), ui.width);
+	if (fixes.length === 0) {
+		pushWrapped(lines, ui.p, "Next action: review the advisory findings, then re-run with full detail if you need the evidence trail.", ui.width);
+		lines.push(nextStep("mjolnir --verbose", ui));
+		lines.push("");
+		return;
+	}
+	pushWrapped(lines, ui.p, "Next action: fix the highest score-gain item below, then re-run the changed scope.", ui.width);
+	lines.push(nextStep("mjolnir --scope changed", ui));
 	for (const { finding: f, scoreGain, autofixable } of fixes) {
 		const gainText = `+${scoreGain} pt${scoreGain === 1 ? "" : "s"}`;
 		const autofixTag = autofixable ? ui.p.ok(" [autofix available]") : "";
@@ -2953,6 +3151,35 @@ function appendFixThisFirst(lines, result, ui) {
 	}
 	lines.push("");
 }
+/** Returns the default-report rationale based on scan completeness and finding severity. */
+function fixFirstWhy(result) {
+	const counts = countBySeverity(result);
+	if (result.partial || result.analysisStatus.discovery === "partial" || result.analysisStatus.rules === "partial") return "Why it matters: this scan is partial, so fix the visible risks but do not treat missing findings as proof of a clean suite.";
+	if (counts.error > 0) return `Why it matters: ${counts.error} error finding${counts.error === 1 ? "" : "s"} can let a false-green or release-blocking test issue survive review.`;
+	if (counts.warning > 0) return `Why it matters: ${counts.warning} warning finding${counts.warning === 1 ? "" : "s"} can turn into flaky triage or weak release confidence.`;
+	return "Why it matters: these advisory findings do not gate CI, but they still mark places where the test signal is weaker than it looks.";
+}
+function appendNextActions(lines, display, fullResult, ui) {
+	const partial = fullResult.partial || fullResult.analysisStatus.discovery === "partial" || fullResult.analysisStatus.rules === "partial";
+	const findings = display.findings;
+	if (findings.length === 0 && fullResult.score !== 100 && !partial) return;
+	lines.push(sectionHeader("NEXT ACTIONS", ui));
+	if (partial) pushWrapped(lines, ui.p, "Partial scan: do not trust this as a release gate yet. Fix scan coverage or rerun with a larger budget before treating the result as clean.", ui.width);
+	if (findings.length > 0) {
+		const first = findings[0];
+		if (first === void 0) return;
+		const loc = `${sanitizeData(first.file)}:${first.line}`;
+		lines.push(nextStep(`mjolnir explain ${sanitizeData(first.ruleId)}`, ui));
+		lines.push(nextStep(`mjolnir why ${loc}`, ui));
+		pushWrapped(lines, ui.p, "Existing debt path: capture the current state once, then review only new or worse findings on future changes.", ui.width);
+		lines.push(nextStep("mjolnir baseline", ui));
+		lines.push(nextStep("mjolnir diff", ui));
+	} else if (fullResult.score === 100) {
+		pushWrapped(lines, ui.p, "Clean path: install the advisory PR workflow so new trust debt is caught before it reaches main.", ui.width);
+		lines.push(nextStep("mjolnir ci install", ui));
+	} else if (partial) lines.push(nextStep("mjolnir --verbose", ui));
+	lines.push("");
+}
 function evidenceTag$1(f) {
 	const level = f.evidenceLevel ?? deriveEvidenceLevel(f.findingType, f.confidence);
 	let tag = `${level} · ${level === "E2" ? "deterministic" : level === "E1" ? "heuristic" : "observation"}`;
@@ -3144,17 +3371,36 @@ function maxSeverity(findings) {
 * VICTORY line: wordmark + the trophy retained inside, all in the
 * forged gold-white pair. The halo hammer itself is the score
 * instrument above — one mark, calmly (brand usage rule); ASCII mode
-* keeps the `*** FLAWLESS VICTORY ***` contract string (test-locked in
-* empty-states/long-tail-arms).
+* labels the result as static rather than claiming a clean suite.
 */
-function appendForgedBlock(lines, p, ascii) {
+function appendForgedBlock(lines, ui) {
+	const { p, ascii } = ui;
 	lines.push("");
-	if (ascii) lines.push(p.forged("*** FLAWLESS VICTORY ***"));
+	if (ascii) lines.push(p.forged("*** ZERO FINDINGS (STATIC) ***"));
 	else lines.push(`  ${p.forged(FORGED_WORDMARK)}`);
-	lines.push(p.forged("  FORGED — zero findings. The suite is clean."));
+	lines.push(p.forged("  FORGED — zero findings on the analyzed surface; runtime evidence is still required for higher trust."));
 	lines.push("");
 	lines.push(p.forged(TROPHY));
 	lines.push("");
+	pushWrapped(lines, p, "Next: re-scan changed tests and keep the advisory CI workflow installed so new regressions are surfaced.", ui.width);
+	lines.push(nextStep("mjolnir --scope changed", ui));
+	lines.push("");
+}
+/**
+* Guidance for partial scans with zero findings and score 100.
+* A partial scan cannot claim a clean suite — the absence of findings
+* may be due to incomplete analysis, not actual cleanliness.
+*/
+function appendPartialCleanGuidance(lines, ui) {
+	const { p } = ui;
+	lines.push("");
+	lines.push(p.warning("  ⚠ PARTIAL SCAN — no findings, but analysis was incomplete"));
+	lines.push("");
+	pushWrapped(lines, p, "This scan did not analyze the full test surface. Zero findings here does not mean the suite is clean — it means the scan was cut short.", ui.width);
+	lines.push("");
+	pushWrapped(lines, p, "Next action: fix the cause of the partial scan (timeouts, exclusions, parse failures), then re-run a complete scan before trusting the gate.", ui.width);
+	lines.push(nextStep("mjolnir --scope changed", ui));
+	lines.push("");
 }
 /**
 * Pushes dimmed prose that respects the terminal width.
@@ -3336,7 +3582,7 @@ function topTrustRisks(findings, n = 3) {
 function nextAction(result) {
 	if (result.partial) return "re-run with a higher --max-duration to close the truncated surface";
 	const risks = topTrustRisks(result.findings, 1);
-	if (risks.length === 0) return result.testDeclarationCount === 0 ? "add tests — a repo without test declarations has nothing to verify" : "nothing to triage — keep the gate green with `mjolnir ci install`";
+	if (risks.length === 0) return result.testDeclarationCount === 0 ? "add tests — a repo without test declarations has nothing to verify" : "no findings on the analyzed surface — install advisory CI (`mjolnir ci install`) and re-scan the changed scope";
 	return `mjolnir explain ${risks[0]?.ruleId ?? ""} — then fix the top risk first`;
 }
 /**
@@ -4085,7 +4331,7 @@ async function runTrustReportCommand(argv, io) {
 	}
 	const targetArg = argv.find((a) => !a.startsWith("-")) ?? ".";
 	const target = resolve(targetArg);
-	if (!validateTarget(target)) {
+	if (!validateTarget$1(target)) {
 		io.err(`error: not a scannable target: ${targetArg}`);
 		return 10;
 	}
@@ -4112,7 +4358,7 @@ async function runTrustReportCommand(argv, io) {
 		return 20;
 	}
 }
-function validateTarget(target) {
+function validateTarget$1(target) {
 	try {
 		return statSync(target).isDirectory();
 	} catch {
@@ -4978,7 +5224,7 @@ function renderDebt(result) {
 	lines.push(sectionHeader("TEST DEBT REGISTER", ui$16));
 	lines.push("");
 	if (classes.length === 0) {
-		lines.push("No tracked debt classes found — the suite is clean.");
+		lines.push("No tracked debt classes found in the current register.");
 		return lines.join("\n");
 	}
 	const rows = ["DEBT CLASS", ""];
@@ -5733,7 +5979,7 @@ function tryReadPackageJson(rootDir) {
 	const p = join(rootDir, "package.json");
 	if (!existsSync(p)) return null;
 	try {
-		return parseJsonFile(readFileSync(p, "utf8"), p, isRecord);
+		return parseJsonFile(readFileSync(p, "utf8"), p, isRecord$2);
 	} catch {
 		return null;
 	}
@@ -7455,7 +7701,7 @@ function computeDetectorHashes(rules, rulesDir, retiredIds = []) {
 	return manifest;
 }
 function loadManifest(path) {
-	return parseJsonFile(readFileSync(path, "utf8"), path, (v) => isRecord(v));
+	return parseJsonFile(readFileSync(path, "utf8"), path, (v) => isRecord$2(v));
 }
 //#endregion
 //#region src/commands/doctor.ts
@@ -7632,7 +7878,7 @@ function checkTierEnforcement(verdictsDir, rules = RULES) {
 			const lines = readFileSync(join(verdictsDir, f), "utf8").split("\n").filter((l) => l.trim().length > 0);
 			for (const line of lines) try {
 				const parsed = JSON.parse(line);
-				if (!isRecord(parsed)) continue;
+				if (!isRecord$2(parsed)) continue;
 				const entry = parsed;
 				if (entry.verdict === "TP" || entry.verdict === "FP") {
 					if (typeof entry.ruleId === "string") live.set(entry.ruleId, (live.get(entry.ruleId) ?? 0) + 1);
@@ -7740,7 +7986,7 @@ function checkFixtureIntegrity(fixturesRoot, rules = RULES) {
 	const allowlistPath = join(fixturesRoot, "typecheck-allowlist.json");
 	if (existsSync(allowlistPath)) try {
 		const raw = JSON.parse(readFileSync(allowlistPath, "utf8"));
-		if (!isRecord(raw)) {
+		if (!isRecord$2(raw)) {
 			ok = false;
 			details.push("typecheck-allowlist.json is not an object");
 		} else if (Array.isArray(raw.entries)) details.push(`Layer A typecheck allowlist: ${raw.entries.length} justified entr(ies)`);
@@ -7854,7 +8100,7 @@ function checkMeasurementConsistency(verdictsDir, sidecarPath, rules = RULES, me
 			let row;
 			try {
 				const parsed = JSON.parse(trimmed);
-				if (!isRecord(parsed)) {
+				if (!isRecord$2(parsed)) {
 					failures.push(`${f}: unparseable verdict row (corpus integrity)`);
 					continue;
 				}
@@ -7871,7 +8117,7 @@ function checkMeasurementConsistency(verdictsDir, sidecarPath, rules = RULES, me
 	let sidecar = {};
 	if (existsSync(sidecarPath)) try {
 		const parsed = JSON.parse(readFileSync(sidecarPath, "utf8"));
-		if (!isRecord(parsed)) failures.push("sidecar is not a valid object — regenerate the measurement artifacts");
+		if (!isRecord$2(parsed)) failures.push("sidecar is not a valid object — regenerate the measurement artifacts");
 		else sidecar = parsed;
 	} catch (e) {
 		failures.push(`sidecar unreadable/malformed: ${errorText(e)} — regenerate the measurement artifacts`);
@@ -10627,60 +10873,48 @@ function runAnalyzeCommand(argv, io) {
 *   gitlab  — generate GitLab CI YAML
 *   jenkins — generate Jenkins Jenkinsfile Groovy
 */
-function generateGitHubWorkflow(findings) {
-	const hasErrors = findings.some((f) => f.severity === "error");
+const SCAN_COMMAND = `npx --yes mjolnir-qa@${ENGINE_VERSION} --blocking error`;
+function generateGitHubWorkflow() {
 	return `name: QA Check
 on: [push, pull_request]
 jobs:
   qa:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install dependencies
         run: npm ci
       - name: Run Mjölnir scan
-        run: npx mjolnir scan
-${findings.map((f) => `      - name: Report ${f.ruleId}\n        run: echo "${f.message}"`).join("\n")}
-      - name: Report result
-        if: ${hasErrors ? "failure()" : "success()"}
-        run: echo "Quality gate: ${hasErrors ? "FAILED" : "PASSED"}"
+        run: ${SCAN_COMMAND}
 `;
 }
-function generateGitLabCi(findings) {
+function generateGitLabCi() {
 	return `stages:
   - test
   - qa
 qa-check:
   stage: qa
   script:
-    - npx mjolnir scan
-    - ${findings.some((f) => f.severity === "error") ? "echo \"Quality gate FAILED\" && exit 1" : "echo \"Quality gate PASSED\""}
+    - ${SCAN_COMMAND}
   rules:
     - if: $CI_PIPELINE_SOURCE == "merge_request_event"
 `;
 }
-function generateJenkinsfile(findings) {
+function generateJenkinsfile() {
 	return `pipeline {
     agent any
     stages {
         stage('QA Check') {
             steps {
-                sh 'npx mjolnir scan'
-                sh 'echo "Quality gate: ${findings.some((f) => f.severity === "error") ? "FAILED" : "PASSED"}"'
+                sh '${SCAN_COMMAND}'
             }
         }
     }
-    post {
-        failure {
-            echo 'QA findings detected — review required'
-        }
-    }
 }
 `;
 }
-async function runCiAdapterCommand(argv, io) {
+function runCiAdapterCommand(argv, io) {
 	const adapter = argv[0] ?? "";
-	const target = (argv.length >= 2 ? argv.slice(1).find((a) => !a.startsWith("-")) : void 0) ?? ".";
 	if (![
 		"github",
 		"gitlab",
@@ -10689,46 +10923,36 @@ async function runCiAdapterCommand(argv, io) {
 		io.err("Usage: mjolnir ci-adapter <github|gitlab|jenkins> [target]");
 		return 10;
 	}
-	let findings = [];
-	try {
-		const { runScan } = await import("./scan-pipeline-C0ka-RmX.mjs");
-		findings = (await runScan({
-			target,
-			json: true,
-			verbose: false,
-			maxDurationMs: Number.POSITIVE_INFINITY,
-			scopeChanged: false,
-			format: "json",
-			strict: false
-		})).findings.map((f) => ({
-			ruleId: f.ruleId,
-			severity: f.severity,
-			message: f.message
-		}));
-	} catch {
-		findings.length = 0;
+	if (argv.length > 2 || argv.slice(1).some((arg) => arg.startsWith("-"))) {
+		io.err("Usage: mjolnir ci-adapter <github|gitlab|jenkins> [target]");
+		return 10;
 	}
+	const target = resolve(argv[1] ?? ".");
 	let output;
 	let filename;
 	switch (adapter) {
 		case "github":
-			output = generateGitHubWorkflow(findings);
+			output = generateGitHubWorkflow();
 			filename = "qa-check.yml";
 			break;
 		case "gitlab":
-			output = generateGitLabCi(findings);
+			output = generateGitLabCi();
 			filename = ".gitlab-ci.yml";
 			break;
 		case "jenkins":
-			output = generateJenkinsfile(findings);
+			output = generateJenkinsfile();
 			filename = "Jenkinsfile";
 			break;
 		default: return 10;
 	}
-	writeFileSync(filename, output);
+	try {
+		writeFileSync(join(target, filename), output);
+	} catch (error) {
+		io.err(`Unable to write CI template: ${error instanceof Error ? error.message : String(error)}`);
+		return 20;
+	}
 	io.out(`CI ADAPTER: ${adapter.toUpperCase()}`);
-	io.out(`Generated ${filename}`);
-	io.out(`Findings processed: ${findings.length}`);
+	io.out(`Generated ${join(target, filename)}`);
 	io.out(output);
 	return 0;
 }
@@ -10787,7 +11011,7 @@ async function runDashboardCommand(argv, io) {
 		return 10;
 	}
 	try {
-		const { runScan } = await import("./scan-pipeline-C0ka-RmX.mjs");
+		const { runScan } = await import("./scan-pipeline-C_Rs4u8N.mjs");
 		const result = await runScan({
 			target,
 			json: true,
@@ -11085,83 +11309,3382 @@ function runMaturityCommand(argv, io) {
 	return 10;
 }
 //#endregion
-//#region src/cli.ts
+//#region src/engine/cli-command-names.ts
+const CLI_COMMAND_NAMES = [
+	"scan",
+	"suppressions",
+	"forensics",
+	"triage",
+	"mutation",
+	"badge",
+	"trust-report",
+	"debt",
+	"impact",
+	"business-case",
+	"release-report",
+	"report",
+	"trend",
+	"exec-report",
+	"policy",
+	"quarantine",
+	"analyze",
+	"ci-adapter",
+	"dashboard",
+	"enterprise",
+	"maturity",
+	"baseline",
+	"diff",
+	"verify",
+	"pr-comment",
+	"summary",
+	"stats",
+	"fix",
+	"create-rule",
+	"handover",
+	"init",
+	"pw-report",
+	"doctor",
+	"release-trust",
+	"rules",
+	"explain",
+	"doctor:playwright",
+	"why",
+	"handoff",
+	"install",
+	"ci-integrity",
+	"framework-maturity",
+	"suppression-gate",
+	"cross-file",
+	"contract-verify",
+	"trust-trend",
+	"evidence-graph",
+	"ci",
+	"mcp",
+	"help"
+];
+const CLI_NON_SCAN_COMMANDS = new Set(CLI_COMMAND_NAMES.filter((command) => command !== "scan"));
+//#endregion
+//#region src/engine/cross-file.ts
+const JS_TEST_NAME_RE = /\b(?:test|it)\s*\(\s*['"`]([^'"`]+)['"`]\s*,/g;
+const PY_TEST_NAME_RE = /^def\s+(test_\w+)\s*\(/gm;
+/** Collect declared test names from one file's text. */
+function collectTestNames(path, text) {
+	const names = [];
+	if (path.endsWith(".py")) {
+		let m;
+		const re = new RegExp(PY_TEST_NAME_RE.source, "gm");
+		while ((m = re.exec(text)) !== null) names.push(m[1]);
+		return names;
+	}
+	if (/\.(?:spec|test)\.[tj]sx?$/.test(path)) {
+		let m;
+		const re = new RegExp(JS_TEST_NAME_RE.source, "g");
+		while ((m = re.exec(text)) !== null) names.push(m[1]);
+	}
+	return names;
+}
+/** Find test names declared in more than one file. */
+function findDuplicateTestNames(files) {
+	const byName = /* @__PURE__ */ new Map();
+	for (const { path, text } of files) for (const name of collectTestNames(path, text)) {
+		const set = byName.get(name) ?? /* @__PURE__ */ new Set();
+		set.add(path);
+		byName.set(name, set);
+	}
+	const out = [];
+	for (const [name, filesSet] of byName) if (filesSet.size > 1) out.push({
+		name,
+		files: [...filesSet].sort()
+	});
+	return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+//#endregion
+//#region src/engine/cross-file-analysis.ts
+/**
+* Analyze cross-file signals across the scanned test files.
+* Pure function — same input always produces same output.
+*/
+function analyzeCrossFileSignals(files, findings, root) {
+	const orderedFiles = [...files].sort((a, b) => a.path.localeCompare(b.path));
+	const duplicateTestNames = findDuplicateTestNames(orderedFiles).map((dup) => ({
+		type: "duplicate-test-name",
+		files: dup.files,
+		message: `Duplicate test name "${dup.name}" found in ${dup.files.length} files`,
+		severity: "warning"
+	}));
+	const sharedImports = detectSharedImports(orderedFiles).map((imp) => ({
+		type: "shared-import",
+		files: imp.files,
+		message: imp.message,
+		severity: "info"
+	}));
+	const circularDependencies = detectCircularDependencies(orderedFiles).map((circ) => ({
+		type: "circular-dep",
+		files: circ.files,
+		message: circ.message,
+		severity: "warning"
+	}));
+	const correlationConclusions = correlateFindings(findings).map((c) => `${c.conclusionType}: ${c.corroboration}`).join("; ");
+	const graph = buildDependencyGraph(root);
+	const reachableFiles = getReachableFiles(orderedFiles.map((f) => f.path), graph);
+	return {
+		signals: [
+			...duplicateTestNames,
+			...sharedImports,
+			...circularDependencies
+		],
+		duplicateTestNames,
+		sharedImports,
+		circularDependencies,
+		correlationConclusions,
+		dependencyGraphSize: graph.size,
+		reachableFilesCount: reachableFiles.length
+	};
+}
+function detectSharedImports(files) {
+	const importByModule = /* @__PURE__ */ new Map();
+	for (const { path, text } of files) {
+		const importRegex = /\b(?:from\s+|import\s*)['"]([^'"]+)['"]/g;
+		let match;
+		while ((match = importRegex.exec(text)) !== null) {
+			const module = match[1];
+			const set = importByModule.get(module) ?? /* @__PURE__ */ new Set();
+			set.add(path);
+			importByModule.set(module, set);
+		}
+	}
+	const out = [];
+	for (const [module, paths] of importByModule) if (paths.size > 1) out.push({
+		files: [...paths].sort(),
+		message: `Module "${module}" imported by ${paths.size} files`
+	});
+	return out.sort((a, b) => a.message.localeCompare(b.message));
+}
+function detectCircularDependencies(files) {
+	const importMap = /* @__PURE__ */ new Map();
+	const filePaths = new Set(files.map((f) => f.path));
+	for (const { path: filePath, text } of files) {
+		const imports = [];
+		const importRegex = /\b(?:from\s+|import\s*)['"]([^'"]+)['"]/g;
+		let match;
+		while ((match = importRegex.exec(text)) !== null) {
+			const imported = match[1];
+			let resolved = imported;
+			if (imported.startsWith("./") || imported.startsWith("../")) resolved = filePath.substring(0, filePath.lastIndexOf("/") + 1) + imported.replace(/^\.\//, "");
+			if (!filePaths.has(resolved)) {
+				for (const ext of [
+					".ts",
+					".tsx",
+					".js",
+					".jsx"
+				]) if (filePaths.has(resolved + ext)) {
+					resolved = resolved + ext;
+					break;
+				}
+			}
+			if (filePaths.has(resolved) || filePaths.has(imported)) imports.push(filePaths.has(resolved) ? resolved : imported);
+		}
+		importMap.set(filePath, imports);
+	}
+	const visited = /* @__PURE__ */ new Set();
+	const recursionStack = /* @__PURE__ */ new Set();
+	const cycles = [];
+	function dfs(node, path) {
+		if (recursionStack.has(node)) {
+			const cycleStart = path.indexOf(node);
+			if (cycleStart !== -1) cycles.push(path.slice(cycleStart).concat(node));
+			return;
+		}
+		if (visited.has(node)) return;
+		visited.add(node);
+		recursionStack.add(node);
+		path.push(node);
+		const deps = importMap.get(node) ?? [];
+		for (const dep of deps) dfs(dep, path);
+		path.pop();
+		recursionStack.delete(node);
+	}
+	for (const node of importMap.keys()) if (!visited.has(node)) dfs(node, []);
+	return cycles.map((cycle) => ({
+		files: cycle,
+		message: `Circular dependency detected: ${cycle.join(" → ")}`
+	}));
+}
+function renderCrossFileAnalysis(result) {
+	const lines = [];
+	lines.push("Cross-File Analysis Report");
+	lines.push(`Signals detected: ${result.signals.length}`);
+	lines.push(`Duplicate test names: ${result.duplicateTestNames.length}`);
+	lines.push(`Shared imports: ${result.sharedImports.length}`);
+	lines.push(`Circular dependencies: ${result.circularDependencies.length}`);
+	lines.push(`Dependency graph size: ${result.dependencyGraphSize}`);
+	lines.push(`Reachable files: ${result.reachableFilesCount}`);
+	lines.push("");
+	if (result.signals.length > 0) {
+		lines.push("Signals:");
+		for (const signal of result.signals) {
+			const icon = signal.severity === "warning" ? "⚠" : "ℹ";
+			lines.push(`  ${icon} [${signal.type}] ${signal.message}`);
+		}
+		lines.push("");
+	}
+	if (result.correlationConclusions) {
+		lines.push("Correlation Conclusions:");
+		lines.push(`  ${result.correlationConclusions}`);
+		lines.push("");
+	}
+	return lines.join("\n").trimEnd();
+}
+//#endregion
+//#region src/engine/evidence-graph.ts
+/**
+* Build a complete evidence graph from a scan result.
+* Pure function — deterministic output for the same input.
+*/
+function buildEvidenceGraphFromScan(result, runIdentity, files) {
+	const nodes = [];
+	const edges = [];
+	const repoNode = {
+		id: `repo:${runIdentity.inputFingerprint}`,
+		type: "repository",
+		label: "Scanned Repository",
+		properties: {
+			scanId: runIdentity.scanId,
+			engineVersion: runIdentity.engineVersion
+		}
+	};
+	nodes.push(repoNode);
+	const runNode = {
+		id: `run:${runIdentity.scanId}`,
+		type: "artifact",
+		label: "Scan Run",
+		properties: {
+			scanId: runIdentity.scanId,
+			rulesDigest: runIdentity.rulesDigest,
+			configFingerprint: runIdentity.configFingerprint
+		}
+	};
+	nodes.push(runNode);
+	edges.push({
+		source: repoNode.id,
+		target: runNode.id,
+		type: "CONTAINS",
+		properties: {}
+	});
+	const fileNodes = /* @__PURE__ */ new Map();
+	for (const finding of result.findings) {
+		if (!fileNodes.has(finding.file)) {
+			const fileNode = {
+				id: `file:${finding.file}`,
+				type: "file",
+				label: finding.file,
+				properties: { path: finding.file }
+			};
+			fileNodes.set(finding.file, fileNode);
+			nodes.push(fileNode);
+			edges.push({
+				source: repoNode.id,
+				target: fileNode.id,
+				type: "CONTAINS",
+				properties: {}
+			});
+		}
+		const findingNode = {
+			id: `finding:${finding.findingId ?? `${finding.ruleId}:${finding.file}:${finding.line}`}`,
+			type: "finding",
+			label: `${finding.ruleId}: ${finding.message}`,
+			properties: {
+				ruleId: finding.ruleId,
+				severity: finding.severity,
+				evidenceLevel: finding.evidenceLevel,
+				trustLevel: finding.trustLevel,
+				confidence: finding.confidence,
+				findingType: finding.findingType
+			}
+		};
+		nodes.push(findingNode);
+		edges.push({
+			source: fileNodes.get(finding.file)?.id ?? "",
+			target: findingNode.id,
+			type: "CONTAINS",
+			properties: {}
+		});
+		edges.push({
+			source: runNode.id,
+			target: findingNode.id,
+			type: "PRODUCED_BY",
+			properties: { detectorRevision: finding.detectorRevision }
+		});
+	}
+	const evidenceCounts = {
+		total: result.findings.length,
+		failed: result.findings.filter((f) => f.severity === "error").length,
+		flaky: 0,
+		skipped: 0,
+		timedOut: 0
+	};
+	const filesForProvenance = files.map((file) => ({
+		path: file.path,
+		provenance: classifyProvenance(file)
+	}));
+	const agenticProfile = computeAgenticProfile(filesForProvenance, result.findings);
+	return {
+		graph: buildEvidenceGraph({
+			runId: runIdentity,
+			source: "scan"
+		}),
+		nodes,
+		edges,
+		agenticProfile,
+		evidenceCounts,
+		provenanceSummary: {
+			totalFiles: filesForProvenance.length,
+			generatedMarkedFiles: agenticProfile.generatedMarkedFiles,
+			codegenLikeFiles: agenticProfile.codegenLikeFiles,
+			shareMarkedGenerated: agenticProfile.shareMarkedGenerated
+		}
+	};
+}
 /**
-* Mjölnir CLI entry point (W1-02).
-* Exit codes (§24.1, frozen): 0 clean · 1 findings ≥ gate · 2 partial ·
-* 10 usage error · 20 internal error.
+* Query the evidence graph for findings related to a specific file.
 */
+function queryFindingsByFile(result, filePath) {
+	return result.findings.filter((f) => f.file === filePath);
+}
 /**
-* Tool version for `mjolnir --version`.
-*
-* A literal, not a package.json read: the shipped artifact is a single
-* bundled `dist/cli.mjs`, so resolving package.json at runtime depends on
-* where the file happens to sit after install. This follows the same
-* discipline as SARIF's `driver.version` — kept in sync by
-* `scripts/sync-sarif-version.cjs` on release and guarded by
-* `tests/version-consistency.spec.ts` locally. R4c moved the literal to
-* src/engine/version.ts (a leaf module) so the scan pipeline's run
-* identity can carry it without a cli.ts import cycle; this re-export
-* keeps every existing consumer stable.
+* Query the evidence graph for findings by rule ID.
 */
-const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isValidFindingRecord, discoverAndParseRuntimeReport, KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID, EVIDENCE_OVERRIDES, SUITE_INVALIDATING_RULE_IDS } = scan_pipeline_exports;
-function parseArgs(argv, onError) {
-	const args = {
-		target: ".",
-		json: false,
-		verbose: false,
-		maxDurationMs: Number.POSITIVE_INFINITY,
-		scopeChanged: false,
-		format: "terminal"
-	};
-	const reject = (detail) => {
-		onError?.(detail);
-		return null;
-	};
-	for (let i = 0; i < argv.length; i++) {
-		const a = argv[i] ?? "";
-		if (a === "--json") {
-			args.json = true;
-			args.format = "json";
-		} else if (a === "--format") {
-			const fmt = argv[++i];
-			if (fmt === void 0) return reject({
-				flag: "--format",
-				token: "(missing)"
-			});
-			if (fmt === "sarif") args.format = "sarif";
-			else if (fmt === "mermaid") args.format = "mermaid";
-			else if (fmt === "codequality") args.format = "codequality";
-			else if (fmt === "json") {
-				args.format = "json";
-				args.json = true;
-			} else if (fmt !== "terminal") return reject({
-				flag: "--format",
-				token: fmt
-			});
-		} else if (a === "--verbose") args.verbose = true;
-		else if (a === "--scope") {
-			const mode = argv[++i];
-			if (mode === "changed") args.scopeChanged = true;
-			else return reject({
-				flag: "--scope",
-				token: mode
-			});
-		} else if (a === "--base") {
-			const ref = argv[++i];
-			if (!ref || ref.startsWith("-")) return reject({
-				flag: "--base",
-				token: ref
-			});
-			args.base = ref;
-		} else if (a === "--max-duration") {
-			const v = Number(argv[++i]);
-			if (!Number.isFinite(v) || v <= 0) return reject({
-				flag: "--max-duration",
-				token: argv[i]
-			});
-			args.maxDurationMs = v * 1e3;
-		} else if (a === "--width") {
+function queryFindingsByRule(result, ruleId) {
+	return result.findings.filter((f) => f.ruleId === ruleId);
+}
+function renderEvidenceGraphResult(result) {
+	const lines = [];
+	lines.push("Evidence Graph Report");
+	lines.push(`Nodes: ${result.nodes.length}`);
+	lines.push(`Edges: ${result.edges.length}`);
+	lines.push(`Total Findings: ${result.nodes.filter((n) => n.type === "finding").length}`);
+	lines.push(`Run ID: ${result.graph.runId?.scanId ?? "N/A"}`);
+	lines.push("");
+	lines.push("Evidence Counts:");
+	lines.push(`  Total: ${result.evidenceCounts.total}`);
+	lines.push(`  Failed: ${result.evidenceCounts.failed}`);
+	lines.push(`  Flaky: ${result.evidenceCounts.flaky}`);
+	lines.push(`  Skipped: ${result.evidenceCounts.skipped}`);
+	lines.push(`  Timed Out: ${result.evidenceCounts.timedOut}`);
+	lines.push("");
+	lines.push("Provenance Summary:");
+	lines.push(`  Total files: ${result.provenanceSummary.totalFiles}`);
+	lines.push(`  Generated-marked: ${result.provenanceSummary.generatedMarkedFiles}`);
+	lines.push(`  Codegen-like: ${result.provenanceSummary.codegenLikeFiles}`);
+	lines.push(`  Share marked generated: ${(result.provenanceSummary.shareMarkedGenerated * 100).toFixed(1)}%`);
+	lines.push("");
+	lines.push("Agentic Profile Note:");
+	lines.push(`  ${result.agenticProfile.note}`);
+	return lines.join("\n").trimEnd();
+}
+//#endregion
+//#region src/frameworks/framework-inventory.ts
+const FRAMEWORK_INVENTORY = [
+	{
+		frameworkId: "playwright",
+		entityType: "E2E_FRAMEWORK",
+		language: "TypeScript/JavaScript",
+		maturity: "F4",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F5",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: [
+			"1.44",
+			"1.45",
+			"1.46",
+			"1.47",
+			"1.48"
+		],
+		keyGapForNextLevel: "GAP-PW-006 parallelism/worker safety analysis"
+	},
+	{
+		frameworkId: "jest",
+		entityType: "TEST_FRAMEWORK",
+		language: "TypeScript/JavaScript",
+		maturity: "F3",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F4",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["29", "30"],
+		keyGapForNextLevel: "GAP-JEST-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "vitest",
+		entityType: "TEST_FRAMEWORK",
+		language: "TypeScript/JavaScript",
+		maturity: "F3",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F4",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: [
+			"1.6",
+			"2.0",
+			"2.1"
+		],
+		keyGapForNextLevel: "GAP-VIT-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "pytest",
+		entityType: "TEST_FRAMEWORK",
+		language: "Python",
+		maturity: "F2",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F3",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: [
+			"7.4",
+			"8.0",
+			"8.1",
+			"8.2",
+			"8.3"
+		],
+		keyGapForNextLevel: "GAP-PY-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "junit",
+		entityType: "TEST_FRAMEWORK",
+		language: "Java",
+		maturity: "F2",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F3",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["5.10", "5.11"],
+		keyGapForNextLevel: "GAP-JU-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "nunit",
+		entityType: "TEST_FRAMEWORK",
+		language: "C#",
+		maturity: "F2",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F3",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["3.14", "4.2"],
+		keyGapForNextLevel: "GAP-NU-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "xunit",
+		entityType: "TEST_FRAMEWORK",
+		language: "C#",
+		maturity: "F2",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F3",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["2.9"],
+		keyGapForNextLevel: "GAP-XU-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "cypress",
+		entityType: "E2E_FRAMEWORK",
+		language: "TypeScript/JavaScript",
+		maturity: "F2",
+		supportStatus: "EXPERIMENTAL",
+		targetMaturity: "F3",
+		targetSupportStatus: "OFFICIAL_PARTIAL",
+		validatedVersions: ["13"],
+		keyGapForNextLevel: "GAP-CY-004 lifecycle modeling"
+	},
+	{
+		frameworkId: "selenium",
+		entityType: "AUTOMATION_LIBRARY",
+		language: "Java/TypeScript/Python",
+		maturity: "F1",
+		supportStatus: "EXPERIMENTAL",
+		targetMaturity: "F2",
+		targetSupportStatus: "OFFICIAL_PARTIAL",
+		validatedVersions: [
+			"4.20",
+			"4.21",
+			"4.22",
+			"4.23",
+			"4.24",
+			"4.25"
+		],
+		keyGapForNextLevel: "GAP-SE-002 AST-based usage analysis"
+	},
+	{
+		frameworkId: "testng",
+		entityType: "TEST_FRAMEWORK",
+		language: "Java",
+		maturity: "F1",
+		supportStatus: "EXPERIMENTAL",
+		targetMaturity: "F2",
+		targetSupportStatus: "OFFICIAL_PARTIAL",
+		validatedVersions: ["7.10", "7.11"],
+		keyGapForNextLevel: "GAP-TN-002 AST-based usage analysis"
+	},
+	{
+		frameworkId: "github-actions",
+		entityType: "CI_PROVIDER",
+		language: "YAML",
+		maturity: "F3",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F4",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["v4"],
+		keyGapForNextLevel: "GAP-GHA-004 advanced matrix strategy modeling"
+	},
+	{
+		frameworkId: "azure-devops",
+		entityType: "CI_PROVIDER",
+		language: "YAML",
+		maturity: "F3",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F4",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["2024"],
+		keyGapForNextLevel: "GAP-AZ-004 stage dependency graph modeling"
+	},
+	{
+		frameworkId: "jenkins",
+		entityType: "CI_PROVIDER",
+		language: "Groovy/YAML",
+		maturity: "F3",
+		supportStatus: "OFFICIAL_PARTIAL",
+		targetMaturity: "F4",
+		targetSupportStatus: "OFFICIAL_FULL",
+		validatedVersions: ["2.440", "2.450"],
+		keyGapForNextLevel: "GAP-JK-004 declarative pipeline advanced features"
+	},
+	{
+		frameworkId: "gitlab-ci",
+		entityType: "CI_PROVIDER",
+		language: "YAML",
+		maturity: "F0",
+		supportStatus: "UNSUPPORTED",
+		targetMaturity: "F1",
+		targetSupportStatus: "DISCOVERED",
+		validatedVersions: [],
+		keyGapForNextLevel: "GAP-GL-001 basic pipeline discovery"
+	}
+];
+function getFrameworkById(frameworkId) {
+	return FRAMEWORK_INVENTORY.find((f) => f.frameworkId === frameworkId);
+}
+//#endregion
+//#region src/frameworks/scorecard.ts
+const SCORECARD_DIMENSIONS = [
+	"discovery",
+	"astUsage",
+	"semanticUnderstanding",
+	"assertionUnderstanding",
+	"lifecycleModeling",
+	"asyncSemantics",
+	"fixtureModeling",
+	"mockingSemantics",
+	"sharedStateAnalysis",
+	"errorClassification",
+	"retrySemantics",
+	"parameterization",
+	"snapshotSemantics",
+	"parallelismWorkerSafety",
+	"runtimeEvidence",
+	"adversarialCorpus",
+	"knownLimitationCoverage",
+	"ciIntegration",
+	"reportingQuality",
+	"configDiscovery",
+	"dependencyGraph",
+	"versionCompatibility",
+	"documentationCoverage",
+	"migrationGuidance",
+	"performanceProfiling",
+	"securityAuditing",
+	"crossFrameworkInterop"
+];
+function makeScorecard(frameworkId, overrides) {
+	return {
+		frameworkId,
+		entries: SCORECARD_DIMENSIONS.map((dim) => {
+			const base = {
+				dimension: dim,
+				current: "NOT_APPLICABLE",
+				target: "NOT_APPLICABLE",
+				gapId: null
+			};
+			const ov = overrides[dim];
+			return ov ? {
+				...base,
+				...ov
+			} : base;
+		})
+	};
+}
+const COMMON_MATURE_OVERRIDES = {
+	reportingQuality: {
+		current: "GOOD",
+		target: "EXCELLENT"
+	},
+	configDiscovery: {
+		current: "GOOD",
+		target: "EXCELLENT"
+	},
+	dependencyGraph: {
+		current: "PARTIAL",
+		target: "GOOD"
+	},
+	versionCompatibility: {
+		current: "GOOD",
+		target: "EXCELLENT"
+	},
+	documentationCoverage: {
+		current: "PARTIAL",
+		target: "GOOD"
+	},
+	migrationGuidance: {
+		current: "PARTIAL",
+		target: "GOOD"
+	},
+	performanceProfiling: {
+		current: "MISSING",
+		target: "PARTIAL"
+	},
+	securityAuditing: {
+		current: "MISSING",
+		target: "PARTIAL"
+	},
+	crossFrameworkInterop: {
+		current: "PARTIAL",
+		target: "GOOD"
+	}
+};
+const COMMON_CI_OVERRIDES = {
+	discovery: {
+		current: "EXCELLENT",
+		target: "EXCELLENT"
+	},
+	semanticUnderstanding: {
+		current: "GOOD",
+		target: "EXCELLENT"
+	},
+	errorClassification: {
+		current: "GOOD",
+		target: "EXCELLENT"
+	},
+	retrySemantics: {
+		current: "GOOD",
+		target: "EXCELLENT"
+	},
+	parameterization: {
+		current: "GOOD",
+		target: "EXCELLENT"
+	},
+	runtimeEvidence: {
+		current: "PARTIAL",
+		target: "GOOD"
+	},
+	adversarialCorpus: {
+		current: "PARTIAL",
+		target: "GOOD"
+	},
+	knownLimitationCoverage: {
+		current: "PARTIAL",
+		target: "GOOD"
+	},
+	ciIntegration: {
+		current: "EXCELLENT",
+		target: "EXCELLENT"
+	},
+	reportingQuality: {
+		current: "GOOD",
+		target: "EXCELLENT"
+	},
+	configDiscovery: {
+		current: "EXCELLENT",
+		target: "EXCELLENT"
+	},
+	versionCompatibility: {
+		current: "GOOD",
+		target: "EXCELLENT"
+	},
+	documentationCoverage: {
+		current: "PARTIAL",
+		target: "GOOD"
+	},
+	migrationGuidance: {
+		current: "PARTIAL",
+		target: "GOOD"
+	},
+	performanceProfiling: {
+		current: "MISSING",
+		target: "PARTIAL"
+	},
+	securityAuditing: {
+		current: "MISSING",
+		target: "PARTIAL"
+	},
+	crossFrameworkInterop: {
+		current: "PARTIAL",
+		target: "GOOD"
+	}
+};
+function withCommonMature(overrides) {
+	return {
+		...COMMON_MATURE_OVERRIDES,
+		...overrides
+	};
+}
+const FRAMEWORK_OVERRIDES = {
+	playwright: withCommonMature({
+		discovery: {
+			current: "EXCELLENT",
+			target: "EXCELLENT"
+		},
+		astUsage: {
+			current: "PARTIAL",
+			target: "EXCELLENT",
+			gapId: "GAP-PW-001"
+		},
+		lifecycleModeling: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-PW-002"
+		},
+		fixtureModeling: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-PW-002"
+		},
+		mockingSemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-PW-003"
+		},
+		sharedStateAnalysis: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-PW-004"
+		},
+		retrySemantics: {
+			current: "GOOD",
+			target: "EXCELLENT"
+		},
+		parameterization: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-PW-005"
+		},
+		snapshotSemantics: {
+			current: "NOT_APPLICABLE",
+			target: "NOT_APPLICABLE"
+		},
+		parallelismWorkerSafety: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-PW-006"
+		},
+		runtimeEvidence: {
+			current: "GOOD",
+			target: "EXCELLENT"
+		},
+		adversarialCorpus: {
+			current: "PARTIAL",
+			target: "GOOD"
+		},
+		knownLimitationCoverage: {
+			current: "PARTIAL",
+			target: "GOOD"
+		},
+		ciIntegration: {
+			current: "GOOD",
+			target: "EXCELLENT"
+		}
+	}),
+	jest: withCommonMature({
+		discovery: {
+			current: "EXCELLENT",
+			target: "EXCELLENT"
+		},
+		astUsage: {
+			current: "GOOD",
+			target: "EXCELLENT"
+		},
+		semanticUnderstanding: {
+			current: "WEAK",
+			target: "GOOD",
+			gapId: "GAP-JEST-002"
+		},
+		assertionUnderstanding: {
+			current: "WEAK",
+			target: "GOOD",
+			gapId: "GAP-JEST-003"
+		},
+		lifecycleModeling: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-JEST-004"
+		},
+		asyncSemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-JEST-005"
+		},
+		fixtureModeling: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-JEST-006"
+		},
+		mockingSemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-JEST-007"
+		},
+		sharedStateAnalysis: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-JEST-008"
+		},
+		errorClassification: {
+			current: "PARTIAL",
+			target: "GOOD"
+		},
+		retrySemantics: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-JEST-009"
+		},
+		parameterization: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-JEST-010"
+		},
+		snapshotSemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-JEST-011"
+		},
+		parallelismWorkerSafety: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-JEST-012"
+		},
+		runtimeEvidence: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-JEST-013"
+		},
+		adversarialCorpus: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-JEST-014"
+		},
+		knownLimitationCoverage: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-JEST-015"
+		},
+		ciIntegration: {
+			current: "GOOD",
+			target: "EXCELLENT"
+		}
+	}),
+	vitest: withCommonMature({
+		discovery: {
+			current: "EXCELLENT",
+			target: "EXCELLENT"
+		},
+		astUsage: {
+			current: "GOOD",
+			target: "EXCELLENT"
+		},
+		semanticUnderstanding: {
+			current: "WEAK",
+			target: "GOOD",
+			gapId: "GAP-VIT-002"
+		},
+		assertionUnderstanding: {
+			current: "WEAK",
+			target: "GOOD",
+			gapId: "GAP-VIT-003"
+		},
+		lifecycleModeling: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-VIT-004"
+		},
+		asyncSemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-VIT-005"
+		},
+		fixtureModeling: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-VIT-006"
+		},
+		mockingSemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-VIT-007"
+		},
+		sharedStateAnalysis: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-VIT-008"
+		},
+		errorClassification: {
+			current: "PARTIAL",
+			target: "GOOD"
+		},
+		retrySemantics: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-VIT-009"
+		},
+		parameterization: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-VIT-010"
+		},
+		snapshotSemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-VIT-011"
+		},
+		parallelismWorkerSafety: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-VIT-012"
+		},
+		runtimeEvidence: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-VIT-013"
+		},
+		adversarialCorpus: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-VIT-014"
+		},
+		knownLimitationCoverage: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-VIT-015"
+		},
+		ciIntegration: {
+			current: "GOOD",
+			target: "EXCELLENT"
+		}
+	}),
+	pytest: withCommonMature({
+		discovery: {
+			current: "GOOD",
+			target: "EXCELLENT"
+		},
+		astUsage: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-PY-001"
+		},
+		semanticUnderstanding: {
+			current: "WEAK",
+			target: "PARTIAL",
+			gapId: "GAP-PY-002"
+		},
+		assertionUnderstanding: {
+			current: "WEAK",
+			target: "PARTIAL",
+			gapId: "GAP-PY-003"
+		},
+		lifecycleModeling: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-PY-004"
+		},
+		asyncSemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-PY-005"
+		},
+		fixtureModeling: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-PY-006"
+		},
+		mockingSemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-PY-007"
+		},
+		sharedStateAnalysis: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-PY-008"
+		},
+		errorClassification: {
+			current: "PARTIAL",
+			target: "GOOD"
+		},
+		retrySemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-PY-009"
+		},
+		parameterization: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-PY-010"
+		},
+		snapshotSemantics: {
+			current: "NOT_APPLICABLE",
+			target: "NOT_APPLICABLE"
+		},
+		parallelismWorkerSafety: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-PY-011"
+		},
+		runtimeEvidence: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-PY-012"
+		},
+		adversarialCorpus: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-PY-013"
+		},
+		knownLimitationCoverage: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-PY-014"
+		},
+		ciIntegration: {
+			current: "PARTIAL",
+			target: "GOOD"
+		}
+	}),
+	junit: withCommonMature({
+		discovery: {
+			current: "GOOD",
+			target: "EXCELLENT"
+		},
+		astUsage: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-JU-001"
+		},
+		semanticUnderstanding: {
+			current: "WEAK",
+			target: "PARTIAL",
+			gapId: "GAP-JU-002"
+		},
+		assertionUnderstanding: {
+			current: "WEAK",
+			target: "PARTIAL",
+			gapId: "GAP-JU-003"
+		},
+		lifecycleModeling: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-JU-004"
+		},
+		asyncSemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-JU-005"
+		},
+		fixtureModeling: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-JU-006"
+		},
+		mockingSemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-JU-007"
+		},
+		sharedStateAnalysis: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-JU-008"
+		},
+		errorClassification: {
+			current: "PARTIAL",
+			target: "GOOD"
+		},
+		retrySemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-JU-009"
+		},
+		parameterization: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-JU-010"
+		},
+		snapshotSemantics: {
+			current: "NOT_APPLICABLE",
+			target: "NOT_APPLICABLE"
+		},
+		parallelismWorkerSafety: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-JU-011"
+		},
+		runtimeEvidence: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-JU-012"
+		},
+		adversarialCorpus: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-JU-013"
+		},
+		knownLimitationCoverage: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-JU-014"
+		},
+		ciIntegration: {
+			current: "PARTIAL",
+			target: "GOOD"
+		}
+	}),
+	nunit: withCommonMature({
+		discovery: {
+			current: "GOOD",
+			target: "EXCELLENT"
+		},
+		astUsage: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-NU-001"
+		},
+		semanticUnderstanding: {
+			current: "WEAK",
+			target: "PARTIAL",
+			gapId: "GAP-NU-002"
+		},
+		assertionUnderstanding: {
+			current: "WEAK",
+			target: "PARTIAL",
+			gapId: "GAP-NU-003"
+		},
+		lifecycleModeling: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-NU-004"
+		},
+		asyncSemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-NU-005"
+		},
+		fixtureModeling: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-NU-006"
+		},
+		mockingSemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-NU-007"
+		},
+		sharedStateAnalysis: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-NU-008"
+		},
+		errorClassification: {
+			current: "PARTIAL",
+			target: "GOOD"
+		},
+		retrySemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-NU-009"
+		},
+		parameterization: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-NU-010"
+		},
+		snapshotSemantics: {
+			current: "NOT_APPLICABLE",
+			target: "NOT_APPLICABLE"
+		},
+		parallelismWorkerSafety: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-NU-011"
+		},
+		runtimeEvidence: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-NU-012"
+		},
+		adversarialCorpus: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-NU-013"
+		},
+		knownLimitationCoverage: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-NU-014"
+		},
+		ciIntegration: {
+			current: "PARTIAL",
+			target: "GOOD"
+		}
+	}),
+	xunit: withCommonMature({
+		discovery: {
+			current: "GOOD",
+			target: "EXCELLENT"
+		},
+		astUsage: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-XU-001"
+		},
+		semanticUnderstanding: {
+			current: "WEAK",
+			target: "PARTIAL",
+			gapId: "GAP-XU-002"
+		},
+		assertionUnderstanding: {
+			current: "WEAK",
+			target: "PARTIAL",
+			gapId: "GAP-XU-003"
+		},
+		lifecycleModeling: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-XU-004"
+		},
+		asyncSemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-XU-005"
+		},
+		fixtureModeling: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-XU-006"
+		},
+		mockingSemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-XU-007"
+		},
+		sharedStateAnalysis: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-XU-008"
+		},
+		errorClassification: {
+			current: "PARTIAL",
+			target: "GOOD"
+		},
+		retrySemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-XU-009"
+		},
+		parameterization: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-XU-010"
+		},
+		snapshotSemantics: {
+			current: "NOT_APPLICABLE",
+			target: "NOT_APPLICABLE"
+		},
+		parallelismWorkerSafety: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-XU-011"
+		},
+		runtimeEvidence: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-XU-012"
+		},
+		adversarialCorpus: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-XU-013"
+		},
+		knownLimitationCoverage: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-XU-014"
+		},
+		ciIntegration: {
+			current: "PARTIAL",
+			target: "GOOD"
+		}
+	}),
+	cypress: withCommonMature({
+		discovery: {
+			current: "GOOD",
+			target: "EXCELLENT"
+		},
+		astUsage: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-CY-001"
+		},
+		semanticUnderstanding: {
+			current: "WEAK",
+			target: "PARTIAL",
+			gapId: "GAP-CY-002"
+		},
+		assertionUnderstanding: {
+			current: "WEAK",
+			target: "PARTIAL",
+			gapId: "GAP-CY-003"
+		},
+		lifecycleModeling: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-CY-004"
+		},
+		asyncSemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-CY-005"
+		},
+		fixtureModeling: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-CY-006"
+		},
+		mockingSemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-CY-007"
+		},
+		sharedStateAnalysis: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-CY-008"
+		},
+		errorClassification: {
+			current: "PARTIAL",
+			target: "GOOD"
+		},
+		retrySemantics: {
+			current: "PARTIAL",
+			target: "GOOD"
+		},
+		parameterization: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-CY-009"
+		},
+		snapshotSemantics: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-CY-010"
+		},
+		parallelismWorkerSafety: {
+			current: "NOT_APPLICABLE",
+			target: "NOT_APPLICABLE"
+		},
+		runtimeEvidence: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-CY-011"
+		},
+		adversarialCorpus: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-CY-012"
+		},
+		knownLimitationCoverage: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-CY-013"
+		},
+		ciIntegration: {
+			current: "PARTIAL",
+			target: "GOOD"
+		}
+	}),
+	selenium: withCommonMature({
+		discovery: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-SE-001"
+		},
+		astUsage: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-SE-002"
+		},
+		semanticUnderstanding: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-SE-003"
+		},
+		assertionUnderstanding: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-SE-004"
+		},
+		lifecycleModeling: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-SE-005"
+		},
+		asyncSemantics: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-SE-006"
+		},
+		fixtureModeling: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-SE-007"
+		},
+		mockingSemantics: {
+			current: "NOT_APPLICABLE",
+			target: "NOT_APPLICABLE"
+		},
+		sharedStateAnalysis: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-SE-008"
+		},
+		errorClassification: {
+			current: "MISSING",
+			target: "WEAK"
+		},
+		retrySemantics: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-SE-009"
+		},
+		parameterization: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-SE-010"
+		},
+		snapshotSemantics: {
+			current: "NOT_APPLICABLE",
+			target: "NOT_APPLICABLE"
+		},
+		parallelismWorkerSafety: {
+			current: "NOT_APPLICABLE",
+			target: "NOT_APPLICABLE"
+		},
+		runtimeEvidence: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-SE-011"
+		},
+		adversarialCorpus: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-SE-012"
+		},
+		knownLimitationCoverage: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-SE-013"
+		},
+		ciIntegration: {
+			current: "MISSING",
+			target: "PARTIAL"
+		}
+	}),
+	testng: withCommonMature({
+		discovery: {
+			current: "PARTIAL",
+			target: "GOOD",
+			gapId: "GAP-TN-001"
+		},
+		astUsage: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-TN-002"
+		},
+		semanticUnderstanding: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-TN-003"
+		},
+		assertionUnderstanding: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-TN-004"
+		},
+		lifecycleModeling: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-TN-005"
+		},
+		asyncSemantics: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-TN-006"
+		},
+		fixtureModeling: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-TN-007"
+		},
+		mockingSemantics: {
+			current: "NOT_APPLICABLE",
+			target: "NOT_APPLICABLE"
+		},
+		sharedStateAnalysis: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-TN-008"
+		},
+		errorClassification: {
+			current: "MISSING",
+			target: "WEAK"
+		},
+		retrySemantics: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-TN-009"
+		},
+		parameterization: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-TN-010"
+		},
+		snapshotSemantics: {
+			current: "NOT_APPLICABLE",
+			target: "NOT_APPLICABLE"
+		},
+		parallelismWorkerSafety: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-TN-011"
+		},
+		runtimeEvidence: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-TN-012"
+		},
+		adversarialCorpus: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-TN-013"
+		},
+		knownLimitationCoverage: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-TN-014"
+		},
+		ciIntegration: {
+			current: "MISSING",
+			target: "PARTIAL"
+		}
+	}),
+	"github-actions": COMMON_CI_OVERRIDES,
+	"azure-devops": COMMON_CI_OVERRIDES,
+	jenkins: COMMON_CI_OVERRIDES,
+	"gitlab-ci": {
+		discovery: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-GL-001"
+		},
+		semanticUnderstanding: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-GL-002"
+		},
+		errorClassification: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-GL-003"
+		},
+		retrySemantics: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-GL-004"
+		},
+		parameterization: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-GL-005"
+		},
+		runtimeEvidence: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-GL-006"
+		},
+		adversarialCorpus: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-GL-007"
+		},
+		knownLimitationCoverage: {
+			current: "MISSING",
+			target: "WEAK",
+			gapId: "GAP-GL-008"
+		},
+		ciIntegration: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-GL-009"
+		},
+		reportingQuality: {
+			current: "MISSING",
+			target: "PARTIAL"
+		},
+		configDiscovery: {
+			current: "MISSING",
+			target: "PARTIAL",
+			gapId: "GAP-GL-010"
+		},
+		versionCompatibility: {
+			current: "MISSING",
+			target: "PARTIAL"
+		},
+		documentationCoverage: {
+			current: "MISSING",
+			target: "PARTIAL"
+		},
+		migrationGuidance: {
+			current: "MISSING",
+			target: "PARTIAL"
+		},
+		crossFrameworkInterop: {
+			current: "MISSING",
+			target: "PARTIAL"
+		}
+	}
+};
+const FRAMEWORK_SCORECARDS = [
+	makeScorecard("playwright", FRAMEWORK_OVERRIDES["playwright"]),
+	makeScorecard("jest", FRAMEWORK_OVERRIDES["jest"]),
+	makeScorecard("vitest", FRAMEWORK_OVERRIDES["vitest"]),
+	makeScorecard("pytest", FRAMEWORK_OVERRIDES["pytest"]),
+	makeScorecard("junit", FRAMEWORK_OVERRIDES["junit"]),
+	makeScorecard("nunit", FRAMEWORK_OVERRIDES["nunit"]),
+	makeScorecard("xunit", FRAMEWORK_OVERRIDES["xunit"]),
+	makeScorecard("cypress", FRAMEWORK_OVERRIDES["cypress"]),
+	makeScorecard("selenium", FRAMEWORK_OVERRIDES["selenium"]),
+	makeScorecard("testng", FRAMEWORK_OVERRIDES["testng"]),
+	makeScorecard("github-actions", FRAMEWORK_OVERRIDES["github-actions"]),
+	makeScorecard("azure-devops", FRAMEWORK_OVERRIDES["azure-devops"]),
+	makeScorecard("jenkins", FRAMEWORK_OVERRIDES["jenkins"]),
+	makeScorecard("gitlab-ci", FRAMEWORK_OVERRIDES["gitlab-ci"])
+];
+//#endregion
+//#region src/engine/framework-maturity.ts
+/**
+* M5 — Framework Maturity Tracking for Playwright.
+*
+* Provides functions to track and report framework maturity levels,
+* with special focus on Playwright's progression from F4 toward F5.
+*/
+const MATURITY_SCORES = {
+	F0: 0,
+	F1: 20,
+	F2: 40,
+	F3: 60,
+	F4: 80,
+	F5: 95
+};
+const SUPPORT_SCORES = {
+	OFFICIAL_FULL: 100,
+	OFFICIAL_PARTIAL: 75,
+	EXPERIMENTAL: 50,
+	DISCOVERED: 25,
+	UNSUPPORTED: 0,
+	DEGRADED: 30,
+	DEPRECATED: 10
+};
+function getPlaywrightMaturity() {
+	const progress = getFrameworkMaturity("playwright");
+	if (!progress) throw new Error("Playwright is missing from the framework inventory");
+	return progress;
+}
+function getPlaywrightMaturityReport() {
+	const progress = getPlaywrightMaturity();
+	const entries = FRAMEWORK_SCORECARDS.find((s) => s.frameworkId === "playwright")?.entries ?? [];
+	const recommendations = [];
+	const missingDimensions = entries.filter((e) => e.current === "MISSING" || e.current === "WEAK");
+	for (const dim of missingDimensions) recommendations.push(`Improve ${dim.dimension} from ${dim.current} to ${dim.target} (gap: ${dim.gapId ?? "none"})`);
+	if (progress.currentMaturity !== progress.targetMaturity) recommendations.push(`Target ${progress.targetMaturity} maturity: complete remaining framework dimensions and achieve OFFICIAL_FULL support`);
+	if (progress.currentSupportStatus !== "OFFICIAL_FULL") recommendations.push(`Upgrade support status from ${progress.currentSupportStatus} to OFFICIAL_FULL`);
+	return {
+		...progress,
+		scorecardEntries: Object.freeze(entries),
+		recommendations
+	};
+}
+function getFrameworkMaturity(frameworkId) {
+	const fw = getFrameworkById(frameworkId);
+	if (!fw) return void 0;
+	const entries = FRAMEWORK_SCORECARDS.find((s) => s.frameworkId === frameworkId)?.entries ?? [];
+	const totalDimensions = entries.length;
+	const completeDimensions = entries.filter((e) => e.current === "EXCELLENT" || e.current === "GOOD").length;
+	const gaps = entries.filter((e) => e.gapId !== null).map((e) => e.gapId ?? "");
+	const currentScore = MATURITY_SCORES[fw.maturity] ?? 0;
+	const supportScore = SUPPORT_SCORES[fw.supportStatus] ?? 0;
+	const dimensionScore = totalDimensions > 0 ? Math.round(completeDimensions / totalDimensions * 100) : 0;
+	const maturityScore = Math.round(currentScore * .4 + supportScore * .3 + dimensionScore * .3);
+	return {
+		frameworkId,
+		currentMaturity: fw.maturity,
+		targetMaturity: fw.targetMaturity,
+		currentSupportStatus: fw.supportStatus,
+		targetSupportStatus: fw.targetSupportStatus,
+		maturityScore,
+		dimensionsComplete: completeDimensions,
+		dimensionsTotal: totalDimensions,
+		gaps,
+		progressPercentage: Math.min(100, Math.round(maturityScore / 100 * 100))
+	};
+}
+function getAllFrameworkMaturity() {
+	return FRAMEWORK_INVENTORY.map((fw) => getFrameworkMaturity(fw.frameworkId)).filter((m) => m !== void 0);
+}
+function renderPlaywrightMaturityReport(report) {
+	const lines = [];
+	lines.push(`Playwright Framework Maturity Report`);
+	lines.push(`Current: ${report.currentMaturity} → Target: ${report.targetMaturity}`);
+	lines.push(`Support: ${report.currentSupportStatus} → ${report.targetSupportStatus}`);
+	lines.push(`Maturity Score: ${report.maturityScore}/100 (${report.progressPercentage}%)`);
+	lines.push(`Dimensions: ${report.dimensionsComplete}/${report.dimensionsTotal} complete`);
+	lines.push("");
+	if (report.gaps.length > 0) {
+		lines.push("Open Gaps:");
+		for (const gap of report.gaps) lines.push(`  - ${gap}`);
+		lines.push("");
+	}
+	if (report.recommendations.length > 0) {
+		lines.push("Recommendations:");
+		for (const rec of report.recommendations) lines.push(`  • ${rec}`);
+	}
+	return lines.join("\n").trimEnd();
+}
+//#endregion
+//#region src/engine/historical-trust.ts
+/**
+* Compute a trust snapshot from a scan result and run identity.
+* Pure function — deterministic output for the same input.
+*/
+function computeTrustSnapshot(result, runIdentity, trustSummary, recordedAt) {
+	return {
+		scanId: runIdentity.scanId,
+		timestamp: recordedAt,
+		score: result.score,
+		findings: result.findings.length,
+		errors: result.findings.filter((f) => f.severity === "error").length,
+		warnings: result.findings.filter((f) => f.severity === "warning").length,
+		infos: result.findings.filter((f) => f.severity === "info").length,
+		advisory: result.findings.filter((f) => f.evidenceLevel === "E0").length,
+		trustLevel: trustSummary.level,
+		confidence: trustSummary.confidence,
+		evidenceCoverage: trustSummary.evidenceCoverage,
+		inconclusiveRate: trustSummary.inconclusiveRate,
+		partial: result.partial,
+		frameworkCount: result.frameworkDetectionUnknown ? 0 : 1,
+		ruleCount: result.findings.length > 0 ? new Set(result.findings.map((f) => f.ruleId)).size : 0
+	};
+}
+/**
+* Analyze trust trends across multiple snapshots.
+* Pure function — deterministic output for the same input.
+*/
+function analyzeTrustTrends(snapshots) {
+	if (snapshots.length < 2) return {
+		snapshots: [...snapshots],
+		overallDirection: "insufficient-data",
+		scoreDelta: 0,
+		findingDelta: 0,
+		confidenceDelta: 0,
+		regressions: [],
+		improvements: [],
+		categorizedDebt: []
+	};
+	const first = snapshots[0];
+	const last = snapshots[snapshots.length - 1];
+	const scoreDelta = (last.score ?? 0) - (first.score ?? 0);
+	const findingDelta = last.findings - first.findings;
+	const confidenceDelta = last.confidence - first.confidence;
+	const regressions = [];
+	const improvements = [];
+	if (scoreDelta < 0) regressions.push({
+		type: "score-drop",
+		description: `Score dropped by ${Math.abs(scoreDelta)} points`,
+		magnitude: Math.abs(scoreDelta),
+		snapshot: last
+	});
+	else if (scoreDelta > 0) improvements.push({
+		type: "score-increase",
+		description: `Score increased by ${scoreDelta} points`,
+		magnitude: scoreDelta,
+		snapshot: last
+	});
+	if (findingDelta > 0) regressions.push({
+		type: "finding-increase",
+		description: `${findingDelta} more findings detected`,
+		magnitude: findingDelta,
+		snapshot: last
+	});
+	else if (findingDelta < 0) improvements.push({
+		type: "finding-decrease",
+		description: `${Math.abs(findingDelta)} fewer findings detected`,
+		magnitude: Math.abs(findingDelta),
+		snapshot: last
+	});
+	if (confidenceDelta < 0) regressions.push({
+		type: "confidence-drop",
+		description: `Confidence dropped by ${Math.abs(confidenceDelta)}`,
+		magnitude: Math.abs(confidenceDelta),
+		snapshot: last
+	});
+	else if (confidenceDelta > 0) improvements.push({
+		type: "confidence-increase",
+		description: `Confidence increased by ${confidenceDelta}`,
+		magnitude: confidenceDelta,
+		snapshot: last
+	});
+	if (last.errors > first.errors) regressions.push({
+		type: "new-error",
+		description: `${last.errors - first.errors} new error(s) detected`,
+		magnitude: last.errors - first.errors,
+		snapshot: last
+	});
+	const overallDirection = regressions.length > improvements.length ? "degrading" : improvements.length > regressions.length ? "improving" : "stable";
+	const categorizedDebt = categorizeTrustDebt(snapshots);
+	return {
+		snapshots: [...snapshots],
+		overallDirection,
+		scoreDelta,
+		findingDelta,
+		confidenceDelta,
+		regressions,
+		improvements,
+		categorizedDebt
+	};
+}
+/**
+* Categorize trust debt from scan snapshots.
+*/
+function categorizeTrustDebt(snapshots) {
+	const debt = [];
+	const latest = snapshots[snapshots.length - 1];
+	if (latest) {
+		if (latest.advisory > 0) debt.push({
+			category: "suppression",
+			description: `${latest.advisory} advisory findings that may be masking issues`,
+			count: latest.advisory,
+			severity: latest.advisory > 10 ? "high" : "medium"
+		});
+		if (latest.inconclusiveRate > .3) debt.push({
+			category: "evidence",
+			description: `High inconclusive rate (${(latest.inconclusiveRate * 100).toFixed(1)}%) suggests incomplete analysis`,
+			count: Math.round(latest.inconclusiveRate * latest.findings),
+			severity: "high"
+		});
+		if (latest.partial) debt.push({
+			category: "framework",
+			description: "Partial scan — some files were not analyzed",
+			count: 1,
+			severity: "medium"
+		});
+		if (latest.warnings > latest.errors * 2) debt.push({
+			category: "weak-assertion",
+			description: "Warning-to-error ratio suggests weak assertions",
+			count: latest.warnings,
+			severity: "low"
+		});
+	}
+	return debt.sort((a, b) => {
+		const severityOrder = {
+			high: 0,
+			medium: 1,
+			low: 2
+		};
+		return severityOrder[a.severity] - severityOrder[b.severity];
+	});
+}
+function renderTrustTrend(trend) {
+	const lines = [];
+	lines.push("Historical Trust Trend Analysis");
+	lines.push(`Snapshots: ${trend.snapshots.length}`);
+	lines.push(`Overall Direction: ${trend.overallDirection}`);
+	lines.push(`Score Delta: ${trend.scoreDelta > 0 ? "+" : ""}${trend.scoreDelta}`);
+	lines.push(`Finding Delta: ${trend.findingDelta > 0 ? "+" : ""}${trend.findingDelta}`);
+	lines.push(`Confidence Delta: ${trend.confidenceDelta > 0 ? "+" : ""}${trend.confidenceDelta}`);
+	lines.push("");
+	if (trend.regressions.length > 0) {
+		lines.push("Regressions:");
+		for (const r of trend.regressions) lines.push(`  ✗ ${r.description} (magnitude: ${r.magnitude})`);
+		lines.push("");
+	}
+	if (trend.improvements.length > 0) {
+		lines.push("Improvements:");
+		for (const i of trend.improvements) lines.push(`  ✓ ${i.description} (magnitude: ${i.magnitude})`);
+		lines.push("");
+	}
+	if (trend.categorizedDebt.length > 0) {
+		lines.push("Trust Debt:");
+		for (const d of trend.categorizedDebt) {
+			const icon = d.severity === "high" ? "🔴" : d.severity === "medium" ? "🟡" : "🟢";
+			lines.push(`  ${icon} [${d.category}] ${d.description} (${d.count})`);
+		}
+		lines.push("");
+	}
+	return lines.join("\n").trimEnd();
+}
+//#endregion
+//#region src/engine/machine-contract-verification.ts
+/**
+* M11 — Machine Contract Verification.
+*
+* Verifies that the machine contract output is consistent with
+* the scan results. Ensures the contract is a faithful
+* projection of the canonical scan result — no fabricated fields,
+* no missing evidence, no drift between the contract and the
+* source data.
+*
+* The contract is the machine-readable truth: every field must
+* be derivable from the scan result, and every derivation must
+* be deterministic.
+*/
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function optionalDeepEqual(actual, expected) {
+	return actual === void 0 && expected === void 0 ? true : isDeepStrictEqual(actual, expected);
+}
+/**
+* Verify that a machine contract is consistent with the scan
+* result it claims to represent. Returns a detailed verification
+* report with any violations found.
+*/
+function verifyMachineContract(result, contract = buildMachineContract(result)) {
+	const violations = [];
+	const checks = [];
+	const expected = buildMachineContract(result);
+	const contractRecord = isRecord$1(contract) ? contract : Object.create(null);
+	const contractVersion = typeof contractRecord.contractVersion === "number" ? contractRecord.contractVersion : 0;
+	const versionMatches = contractVersion === 1;
+	if (!versionMatches) violations.push(`Unsupported contract version ${contractVersion}`);
+	checks.push({
+		name: "contract-version",
+		status: versionMatches ? "pass" : "fail",
+		detail: versionMatches ? `Contract version ${contractVersion} confirmed` : `Unsupported contract version ${contractVersion}`
+	});
+	const suppliedSummary = contractRecord.summary;
+	const digestMatch = isRecord$1(suppliedSummary) && suppliedSummary.digest === expected.summary.digest;
+	if (!digestMatch) violations.push("Machine contract digest mismatch");
+	checks.push({
+		name: "digest-integrity",
+		status: digestMatch ? "pass" : "fail",
+		detail: digestMatch ? "Digest matches scan result" : "Digest does not match scan result"
+	});
+	const summaryMatch = isDeepStrictEqual(suppliedSummary, expected.summary);
+	if (!summaryMatch) violations.push("Machine contract summary mismatch");
+	checks.push({
+		name: "summary",
+		status: summaryMatch ? "pass" : "fail",
+		detail: summaryMatch ? "Summary matches scan result" : "Summary does not match scan result"
+	});
+	const trustSummaryMatch = optionalDeepEqual(contractRecord.trustSummary, expected.trustSummary);
+	if (!trustSummaryMatch) violations.push("Trust summary mismatch");
+	checks.push({
+		name: "trust-summary",
+		status: trustSummaryMatch ? "pass" : "fail",
+		detail: trustSummaryMatch ? "Trust summary consistent with contract" : "Trust summary does not match scan result"
+	});
+	const provenanceMatch = optionalDeepEqual(contractRecord.provenance, expected.provenance);
+	if (!provenanceMatch) violations.push("Provenance mismatch");
+	checks.push({
+		name: "provenance",
+		status: provenanceMatch ? "pass" : "fail",
+		detail: provenanceMatch ? "Provenance matches scan result" : "Provenance does not match scan result"
+	});
+	const forensicVerdictsMatch = optionalDeepEqual(contractRecord.forensicVerdicts, expected.forensicVerdicts);
+	if (!forensicVerdictsMatch) violations.push("Forensic verdicts mismatch");
+	checks.push({
+		name: "forensic-verdicts",
+		status: forensicVerdictsMatch ? "pass" : "fail",
+		detail: forensicVerdictsMatch ? "Forensic verdicts match scan result" : "Forensic verdicts do not match scan result"
+	});
+	const evidenceIntegrity = verifyEvidenceIntegrity(result);
+	if (!evidenceIntegrity) {
+		violations.push("Evidence integrity check failed");
+		checks.push({
+			name: "evidence-integrity",
+			status: "fail",
+			detail: "Evidence in contract does not match scan result"
+		});
+	} else checks.push({
+		name: "evidence-integrity",
+		status: "pass",
+		detail: "All evidence in contract matches scan result"
+	});
+	const completenessCheck = verifyCompleteness(result, contractRecord.completeness, expected.completeness);
+	if (completenessCheck.length > 0) {
+		violations.push(...completenessCheck);
+		checks.push({
+			name: "completeness",
+			status: "fail",
+			detail: `${completenessCheck.length} completeness violation(s) found`
+		});
+	} else checks.push({
+		name: "completeness",
+		status: "pass",
+		detail: "All completeness fields verified"
+	});
+	const findingCount = Array.isArray(result.findings) ? result.findings.length : 0;
+	const annotationsMatch = isDeepStrictEqual(contractRecord.annotations, expected.annotations) && contractRecord.annotationsTruncated === expected.annotationsTruncated;
+	if (!annotationsMatch) violations.push("Annotation projection mismatch");
+	checks.push({
+		name: "annotations",
+		status: annotationsMatch ? "pass" : "fail",
+		detail: annotationsMatch ? `Expected ${findingCount} annotation(s)` : `Expected ${expected.annotations.length} annotation(s)`
+	});
+	return {
+		passed: violations.length === 0,
+		contractVersion,
+		violations,
+		digestMatch,
+		summaryMatch,
+		completenessCheck,
+		trustSummaryMatch,
+		provenanceMatch,
+		forensicVerdictsMatch,
+		annotationsMatch,
+		evidenceIntegrity,
+		checks,
+		summary: {
+			findings: findingCount,
+			score: result.score
+		}
+	};
+}
+function verifyEvidenceIntegrity(result) {
+	if (!Array.isArray(result.findings)) return false;
+	for (const finding of result.findings) if (!finding.ruleId || !finding.file || !finding.message || !Number.isInteger(finding.line) || finding.line < 1 || !Number.isInteger(finding.column) || finding.column < 1) return false;
+	return true;
+}
+function verifyCompleteness(result, completeness, expected) {
+	const violations = [];
+	if (!isRecord$1(completeness)) return ["Missing completeness"];
+	const supplied = completeness;
+	if (supplied.partial !== result.partial) violations.push("Partial flag mismatch");
+	if (!isDeepStrictEqual(supplied, expected)) violations.push("Completeness projection mismatch");
+	if (!result.analysisStatus) violations.push("Missing analysisStatus");
+	return violations;
+}
+function renderContractVerification(result) {
+	const lines = [];
+	lines.push("Machine Contract Verification");
+	lines.push(`Result: ${result.passed ? "PASSED" : "FAILED"}`);
+	lines.push(`Contract Version: ${result.contractVersion}`);
+	lines.push(`Digest Match: ${result.digestMatch}`);
+	lines.push(`Summary Match: ${result.summaryMatch}`);
+	lines.push(`Trust Summary Match: ${result.trustSummaryMatch}`);
+	lines.push(`Provenance Match: ${result.provenanceMatch}`);
+	lines.push(`Forensic Verdicts Match: ${result.forensicVerdictsMatch}`);
+	lines.push(`Annotations Match: ${result.annotationsMatch}`);
+	lines.push(`Evidence Integrity: ${result.evidenceIntegrity}`);
+	if (result.freshScanMatch !== void 0) lines.push(`Fresh Scan Match: ${result.freshScanMatch}`);
+	if (result.artifactResultMatch !== void 0) lines.push(`Artifact Result Match: ${result.artifactResultMatch}`);
+	lines.push(`Findings: ${result.summary.findings}`);
+	lines.push(`Score: ${result.summary.score}`);
+	lines.push("");
+	if (result.violations.length > 0) {
+		lines.push("Violations:");
+		for (const v of result.violations) lines.push(`  ✗ ${v}`);
+		lines.push("");
+	}
+	return lines.join("\n").trimEnd();
+}
+//#endregion
+//#region src/engine/suppression-integrity.ts
+/**
+* ENGINE-006 — Suppression Integrity: detect suppression abuse,
+* unknown rules, expired entries, and compute a full integrity report.
+*
+* Pure module: no filesystem, no clock injection beyond an optional
+* `now` parameter — deterministic by construction.
+*/
+/**
+* Deterministic sha256 fingerprint of the suppression set. Canonical
+* JSON sorted by ruleId+files+reason+expires so order in the config
+* file does not affect the hash.
+*/
+function suppressionFingerprint(suppressions) {
+	const canonical = suppressions.map((s) => ({
+		ruleId: s.ruleId,
+		files: [...s.files ?? []].sort(),
+		reason: s.reason,
+		...s.expires !== void 0 ? { expires: s.expires } : {}
+	})).sort((a, b) => a.ruleId.localeCompare(b.ruleId));
+	return createHash("sha256").update(JSON.stringify(canonical)).digest("hex");
+}
+/**
+* Detect when suppressions cover an unusually large fraction of
+* findings. Default threshold is 50% (0.5).
+*/
+function detectMassSuppression(suppressions, findings, threshold = .5) {
+	const matchers = suppressions.map((suppression) => ({
+		ruleId: suppression.ruleId,
+		patterns: (suppression.files ?? []).map((glob) => globToRegExp(glob.replaceAll("\\", "/"))),
+		ruleOnly: !suppression.files?.length
+	}));
+	const suppressedCount = findings.filter((finding) => {
+		const file = finding.file.replaceAll("\\", "/");
+		return matchers.some((matcher) => matcher.ruleId === finding.ruleId && (matcher.ruleOnly || matcher.patterns.some((pattern) => pattern.test(file))));
+	}).length;
+	const totalFindings = findings.length;
+	const ratio = totalFindings === 0 ? 0 : suppressedCount / totalFindings;
+	return {
+		isMassSuppression: ratio >= threshold,
+		suppressedCount,
+		totalFindings,
+		ratio,
+		threshold
+	};
+}
+/**
+* Find suppressions that reference ruleIds not in the known set.
+*/
+function detectUnknownRuleSuppressions(suppressions, knownRuleIds) {
+	const unknown = /* @__PURE__ */ new Set();
+	for (const s of suppressions) if (!knownRuleIds.has(s.ruleId)) unknown.add(s.ruleId);
+	return [...unknown].sort();
+}
+/**
+* Find suppressions whose expiration date has passed.
+*/
+function detectExpiredSuppressions(suppressions, now = /* @__PURE__ */ new Date()) {
+	const nowMs = now.getTime();
+	return suppressions.filter((s) => {
+		if (s.expires === void 0) return false;
+		return new Date(s.expires).getTime() <= nowMs;
+	});
+}
+/**
+* Full suppression integrity report combining all checks.
+*/
+function computeSuppressionIntegrity(suppressions, findings, knownRuleIds, now = /* @__PURE__ */ new Date()) {
+	return {
+		fingerprint: suppressionFingerprint(suppressions),
+		massSuppression: detectMassSuppression(suppressions, findings),
+		unknownRuleSuppressions: detectUnknownRuleSuppressions(suppressions, knownRuleIds),
+		expiredSuppressions: detectExpiredSuppressions(suppressions, now)
+	};
+}
+//#endregion
+//#region src/engine/suppression-governance.ts
+/**
+* M6 — Suppression Policy Governance Gate.
+*
+* Provides functions to enforce suppression policy governance,
+* detecting abuse, expired entries, unknown rules, and computing
+* a full governance gate result.
+*/
+const DEFAULT_SUPPRESSION_POLICY = {
+	maxMassSuppressionRatio: .5,
+	requireExpiration: false,
+	allowedRuleIds: [],
+	maxTotalSuppressions: 100,
+	maxExpiredSuppressions: 10
+};
+function computeSuppressionGovernanceGate(suppressions, findings, policy = DEFAULT_SUPPRESSION_POLICY, knownRuleIds, now = /* @__PURE__ */ new Date()) {
+	const allIntegrityReport = computeSuppressionIntegrity(suppressions, findings, knownRuleIds ?? /* @__PURE__ */ new Set(), now);
+	const activeSuppressions = suppressions.filter((suppression) => isSuppressionActive(suppression, now));
+	const integrityReport = {
+		...allIntegrityReport,
+		massSuppression: detectMassSuppression(activeSuppressions, findings)
+	};
+	const policyViolations = [];
+	if (integrityReport.massSuppression.ratio > policy.maxMassSuppressionRatio) policyViolations.push(`Mass suppression ratio ${integrityReport.massSuppression.ratio.toFixed(2)} exceeds policy maximum ${policy.maxMassSuppressionRatio}`);
+	if (policy.requireExpiration) {
+		const permanentCount = suppressions.filter((suppression) => suppression.expires === void 0).length;
+		if (permanentCount > 0) policyViolations.push(`Suppressions without an expiration: ${permanentCount}`);
+		const expired = integrityReport.expiredSuppressions;
+		if (expired.length > policy.maxExpiredSuppressions) policyViolations.push(`Expired suppressions (${expired.length}) exceed policy maximum ${policy.maxExpiredSuppressions}`);
+	}
+	if (suppressions.length > policy.maxTotalSuppressions) policyViolations.push(`Total suppressions (${suppressions.length}) exceed policy maximum ${policy.maxTotalSuppressions}`);
+	if (knownRuleIds !== void 0 && integrityReport.unknownRuleSuppressions.length > 0) {
+		const disallowedUnknown = policy.allowedRuleIds.length > 0 ? integrityReport.unknownRuleSuppressions.filter((ruleId) => !policy.allowedRuleIds.includes(ruleId)) : integrityReport.unknownRuleSuppressions;
+		if (disallowedUnknown.length > 0) policyViolations.push(`Unknown rule suppressions: ${disallowedUnknown.join(", ")}`);
+	}
+	const expiredCount = integrityReport.expiredSuppressions.length;
+	const unknownRuleCount = integrityReport.unknownRuleSuppressions.length;
+	return {
+		passed: policyViolations.length === 0,
+		integrityReport,
+		policyViolations,
+		massSuppression: integrityReport.massSuppression,
+		expiredCount,
+		unknownRuleCount,
+		totalSuppressions: suppressions.length,
+		fingerprint: integrityReport.fingerprint
+	};
+}
+function renderSuppressionGovernanceResult(result) {
+	const lines = [];
+	lines.push(`Suppression Policy Governance Gate`);
+	lines.push(`Result: ${result.passed ? "PASSED" : "FAILED"}`);
+	lines.push(`Total Suppressions: ${result.totalSuppressions}`);
+	lines.push(`Mass Suppression Ratio: ${result.massSuppression.ratio.toFixed(2)} (threshold: ${result.massSuppression.threshold})`);
+	lines.push(`Expired: ${result.expiredCount}, Unknown Rules: ${result.unknownRuleCount}`);
+	lines.push(`Fingerprint: ${result.fingerprint}`);
+	lines.push("");
+	if (result.policyViolations.length > 0) {
+		lines.push("Policy Violations:");
+		for (const v of result.policyViolations) lines.push(`  ✗ ${v}`);
+	} else lines.push("All suppression policy checks passed.");
+	return lines.join("\n").trimEnd();
+}
+//#endregion
+//#region src/adapters/gitlab-ci.ts
+function parseGitLabCi(content) {
+	const parsed = parse(content);
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("GitLab CI YAML is not a valid object.");
+	return parsed;
+}
+//#endregion
+//#region src/engine/verification-intelligence.ts
+const CI_WORKFLOW_FILES = [
+	".github/workflows/ci.yml",
+	".github/workflows/test.yml",
+	".github/workflows/qa.yml",
+	".gitlab-ci.yml",
+	".gitlab-ci.yaml",
+	"Jenkinsfile"
+];
+const OPTIONS_WITH_VALUES = /* @__PURE__ */ new Set([
+	"--base",
+	"--blocking",
+	"--category",
+	"--config",
+	"--fail-on",
+	"--format",
+	"--max-duration",
+	"--output",
+	"--rules",
+	"--scope",
+	"--width"
+]);
+const GITLAB_RESERVED_KEYS = /* @__PURE__ */ new Set([
+	"after_script",
+	"before_script",
+	"cache",
+	"default",
+	"image",
+	"include",
+	"services",
+	"stages",
+	"variables",
+	"workflow"
+]);
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function conditionState(value) {
+	if (value === void 0 || value === null || value === true) return "active";
+	if (value === false) return "disabled";
+	if (typeof value !== "string") return "dynamic";
+	const normalized = value.trim().toLowerCase();
+	if (normalized.startsWith("${{")) return "dynamic";
+	if (normalized === "false") return "disabled";
+	if ([
+		"",
+		"true",
+		"always()",
+		"success()"
+	].includes(normalized)) return "active";
+	return "dynamic";
+}
+function isContinueOnError(value) {
+	if (value === void 0 || value === null || value === false) return false;
+	if (value === true) return true;
+	if (typeof value !== "string") return true;
+	const normalized = value.trim().toLowerCase();
+	if (normalized.startsWith("${{")) return true;
+	return normalized !== "false";
+}
+function parseGithubJobs(content) {
+	const document = parseYamlGuarded(content, {
+		invalidPrefix: "Invalid workflow YAML",
+		rootMessage: "Workflow root must be a mapping",
+		depthMessage: "Workflow nesting depth exceeds limit"
+	});
+	if (document === null || document === void 0) return {};
+	if (!isRecord(document)) throw new Error("Workflow root must be a mapping");
+	const jobs = document.jobs;
+	if (jobs === void 0 || jobs === null) return {};
+	if (!isRecord(jobs)) throw new Error("\"jobs\" must be a mapping");
+	const result = Object.create(null);
+	for (const [name, value] of Object.entries(jobs)) if (isRecord(value)) result[name] = value;
+	return result;
+}
+function isEnvironmentName(name) {
+	const first = name.charCodeAt(0);
+	if (!(first >= 65 && first <= 90 || first >= 97 && first <= 122 || first === 95)) return false;
+	for (let index = 1; index < name.length; index++) {
+		const code = name.charCodeAt(index);
+		if (!(code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122 || code === 95)) return false;
+	}
+	return true;
+}
+function stripEnvironmentAssignments(command) {
+	let normalized = command.trim();
+	while (true) {
+		const equals = normalized.indexOf("=");
+		const space = normalized.search(/\s/);
+		if (equals <= 0 || space >= 0 && equals > space) break;
+		if (!isEnvironmentName(normalized.slice(0, equals))) break;
+		let end = equals + 1;
+		const quote = normalized[end];
+		if (quote === "\"" || quote === "'") {
+			const closing = normalized.indexOf(quote, end + 1);
+			if (closing < 0) break;
+			end = closing + 1;
+		} else {
+			const nextSpace = normalized.slice(end).search(/\s/);
+			end = nextSpace < 0 ? normalized.length : end + nextSpace;
+		}
+		normalized = normalized.slice(end).trimStart();
+	}
+	return normalized;
+}
+function normalizeCommand(command) {
+	let normalized = command.trim();
+	const prefixes = [
+		"if ",
+		"then ",
+		"do ",
+		"else ",
+		"elif ",
+		"while ",
+		"until "
+	];
+	if (normalized.startsWith("!")) return "";
+	while (prefixes.some((prefix) => normalized.startsWith(prefix))) normalized = normalized.slice(normalized.indexOf(" ") + 1).trimStart();
+	normalized = stripEnvironmentAssignments(normalized);
+	for (const prefix of [
+		"sudo ",
+		"command ",
+		"exec ",
+		"env "
+	]) if (normalized.startsWith(prefix)) {
+		normalized = normalized.slice(prefix.length).trimStart();
+		break;
+	}
+	return stripEnvironmentAssignments(normalized).trim();
+}
+function isMjolnirPackage(token) {
+	return token === "mjolnir" || token === "mjolnir.cmd" || token === "mjolnir-qa" || token === "mjolnir-qa.cmd" || token.startsWith("mjolnir@") || token.startsWith("mjolnir-qa@") || /^https?:\/\/[^ ]*\/mjolnir-qa(?:-|\/)/i.test(token);
+}
+function commandInvocation(command) {
+	const tokens = normalizeCommand(command).split(/\s+/).filter(Boolean);
+	let runnerIndex = -1;
+	if (tokens[0] && isMjolnirPackage(tokens[0])) runnerIndex = 0;
+	else if (tokens[0] === "npx") {
+		const optionsWithValues = /* @__PURE__ */ new Set([
+			"--cache",
+			"--package",
+			"-p",
+			"--registry"
+		]);
+		for (let index = 1; index < tokens.length; index++) {
+			const token = Reflect.get(tokens, index);
+			if (token.length === 2 && token[0] === "-" && token[1] === "-") continue;
+			if (optionsWithValues.has(token)) {
+				index++;
+				continue;
+			}
+			if (token.startsWith("-")) continue;
+			if (isMjolnirPackage(token)) runnerIndex = index;
+			break;
+		}
+	} else if (tokens[0] === "npm" && tokens[1] === "exec") {
+		const optionsWithValues = /* @__PURE__ */ new Set(["--package", "-p"]);
+		for (let index = 2; index < tokens.length; index++) {
+			const token = Reflect.get(tokens, index);
+			if (token.length === 2 && token[0] === "-" && token[1] === "-") continue;
+			if (optionsWithValues.has(token)) {
+				index++;
+				continue;
+			}
+			if (token.startsWith("-")) continue;
+			if (isMjolnirPackage(token)) runnerIndex = index;
+			break;
+		}
+	} else if (tokens[0] === "npm" && tokens[1] === "run") {
+		if (tokens[2] === "self-scan") runnerIndex = 2;
+	} else if (tokens[0] === "node" && (tokens[1] === "dist/cli.mjs" || tokens[1] === "./dist/cli.mjs")) runnerIndex = 1;
+	return runnerIndex >= 0 ? { args: tokens.slice(runnerIndex + 1).join(" ") } : null;
+}
+function firstPositional(args) {
+	const tokens = args.split(/\s+/).filter(Boolean);
+	for (let index = 0; index < tokens.length; index++) {
+		const token = tokens[index];
+		if (!token || /^(?:[<>]|>>?)$/.test(token)) continue;
+		if (token.startsWith("-")) {
+			if (!token.includes("=") && OPTIONS_WITH_VALUES.has(token)) index++;
+			continue;
+		}
+		return token;
+	}
+	return null;
+}
+function isPotentialScanInvocation(command) {
+	const invocation = commandInvocation(command);
+	if (!invocation) return false;
+	if (/(?:^|\s)(?:-h|--help|--version|-v)(?=\s|$)/.test(invocation.args)) return false;
+	const positional = firstPositional(invocation.args);
+	return positional === null || !CLI_NON_SCAN_COMMANDS.has(positional);
+}
+function isScanInvocation(command) {
+	if (!isPotentialScanInvocation(command)) return false;
+	const invocation = commandInvocation(command);
+	if (!invocation) return false;
+	return !/(?:^|\s)--blocking(?:=|\s+)none(?=\s|$)/.test(invocation.args);
+}
+function isMjolnirInvocation(command) {
+	return isPotentialScanInvocation(command);
+}
+function runParts(run) {
+	const result = [];
+	let current = "";
+	let quote = null;
+	let escaped = false;
+	const push = (terminator) => {
+		if (current.trim() && !current.trim().startsWith("#")) result.push(terminator ? {
+			command: current,
+			terminator
+		} : { command: current });
+		current = "";
+	};
+	for (let index = 0; index < run.length; index++) {
+		const character = run[index];
+		if (escaped) {
+			current += character;
+			escaped = false;
+			continue;
+		}
+		if (character === "\\" && quote !== "'") {
+			current += character;
+			escaped = true;
+			continue;
+		}
+		if (quote) {
+			current += character;
+			if (character === quote) quote = null;
+			continue;
+		}
+		if (character === "\"" || character === "'") {
+			quote = character;
+			current += character;
+			continue;
+		}
+		if (character === ";" || character === "\n" || character === "\r") {
+			push(";");
+			continue;
+		}
+		if (character === "&" && run[index + 1] === "&") {
+			push("&&");
+			index++;
+			continue;
+		}
+		if (character === "|" && run[index + 1] === "|") {
+			push("||");
+			index++;
+			continue;
+		}
+		if (character === "&" || character === "|") {
+			push(character);
+			continue;
+		}
+		current += character;
+	}
+	push();
+	return result;
+}
+function hasPipefail(run) {
+	const tokens = run.trim().split(/\s+/);
+	for (let index = 0; index < tokens.length; index++) {
+		if (tokens[index] !== "set") continue;
+		let hasPipefailOption = false;
+		for (let next = index + 1; next < tokens.length; next++) {
+			const token = tokens[next] ?? "";
+			if (token.length >= 8 && token.startsWith("pipefail")) return hasPipefailOption;
+			if (!token.startsWith("-")) break;
+			if (token.length > 1 && token[0] === "-" && token.includes("o")) hasPipefailOption = true;
+		}
+	}
+	return false;
+}
+function hasDynamicShellCondition(run) {
+	return runParts(run).some(({ command }) => {
+		const tokens = command.trim().split(/\s+/);
+		const control = tokens[0];
+		if (control && [
+			"while",
+			"until",
+			"for",
+			"case"
+		].includes(control)) return true;
+		const ifIndex = tokens.indexOf("if");
+		if (ifIndex < 0 || ifIndex === tokens.length - 1) return false;
+		const condition = tokens.slice(ifIndex + 1).join(" ");
+		return condition !== "true" && condition !== "success()" && condition !== "always()";
+	});
+}
+function runHasScanGate(run) {
+	if (/\bset\s+\+e\b/.test(run)) return false;
+	if (runParts(run).filter((part) => part.terminator === "|").length > 0 && !hasPipefail(run)) return false;
+	if (hasDynamicShellCondition(run)) return false;
+	const parts = runParts(run);
+	for (let index = 0; index < parts.length; index++) {
+		const part = parts[index];
+		if (!part || part.terminator === "||" || part.terminator === "&") continue;
+		if (!isScanInvocation(part.command)) continue;
+		const next = parts[index + 1]?.command.trim();
+		if (part.terminator === ";" && next !== void 0 && /^(?:true|:|exit\s+0)$/.test(next)) return false;
+		return true;
+	}
+	return false;
+}
+function runHasMjolnirCommand(run) {
+	return runParts(run).some(({ command }) => isMjolnirInvocation(command));
+}
+function analyzeGithubWorkflow(content) {
+	const jobs = parseGithubJobs(content);
+	let hasGate = false;
+	let hasCandidate = false;
+	let hasNonGatingCandidate = false;
+	for (const job of Object.values(jobs)) {
+		const jobState = conditionState(job.if);
+		const steps = Array.isArray(job.steps) ? job.steps : [];
+		for (const rawStep of steps) {
+			if (!isRecord(rawStep) || typeof rawStep.run !== "string") continue;
+			if (!runHasMjolnirCommand(rawStep.run)) continue;
+			hasCandidate = true;
+			const stepState = conditionState(rawStep.if);
+			const continueOnError = isContinueOnError(rawStep["continue-on-error"] ?? job["continue-on-error"]);
+			if (jobState === "active" && stepState === "active" && !continueOnError && runHasScanGate(rawStep.run)) hasGate = true;
+			else hasNonGatingCandidate = true;
+		}
+	}
+	return {
+		hasGate,
+		hasCandidate,
+		hasNonGatingCandidate
+	};
+}
+function asCommands(value) {
+	if (Array.isArray(value)) return value.filter((entry) => typeof entry === "string");
+	return typeof value === "string" ? [value] : [];
+}
+function gitlabRuleState(rules) {
+	if (!Array.isArray(rules)) return "dynamic";
+	let unconditional = false;
+	for (const rawRule of rules) {
+		if (!isRecord(rawRule)) continue;
+		if (rawRule.allow_failure !== void 0 && rawRule.allow_failure !== false) return "disabled";
+		const when = rawRule.when;
+		if (when === "never") continue;
+		if (when === "manual" || when === "delayed" || when === "on_failure") return "dynamic";
+		const state = conditionState(rawRule.if);
+		if (state === "active" && rawRule.if === void 0) unconditional = true;
+		else if (state !== "disabled") return "dynamic";
+	}
+	return unconditional ? "active" : "disabled";
+}
+function gitlabJobState(job) {
+	const allowFailure = job.allow_failure;
+	if (allowFailure !== void 0 && allowFailure !== false) return "disabled";
+	const when = job.when;
+	if (when === "never" || when === "manual" || when === "delayed" || when === "on_failure") return "disabled";
+	if (job.only !== void 0 || job.except !== void 0) return "dynamic";
+	if (job.rules !== void 0) return gitlabRuleState(job.rules);
+	return "active";
+}
+function analyzeGitlabWorkflow(content) {
+	const config = parseGitLabCi(content);
+	const globalCommands = [...asCommands(config.before_script).map((command) => ({
+		command,
+		advisory: false
+	})), ...asCommands(config.after_script).map((command) => ({
+		command,
+		advisory: true
+	}))];
+	const workflowState = isRecord(config.workflow) && config.workflow.rules !== void 0 ? gitlabRuleState(config.workflow.rules) : "active";
+	let hasGate = false;
+	let hasCandidate = false;
+	let hasNonGatingCandidate = false;
+	for (const [name, value] of Object.entries(config)) {
+		if (GITLAB_RESERVED_KEYS.has(name) || !isRecord(value)) continue;
+		const state = gitlabJobState(value);
+		const commands = [
+			...globalCommands,
+			...asCommands(value.before_script).map((command) => ({
+				command,
+				advisory: false
+			})),
+			...asCommands(value.script).map((command) => ({
+				command,
+				advisory: false
+			})),
+			...asCommands(value.after_script).map((command) => ({
+				command,
+				advisory: true
+			}))
+		];
+		for (const { command, advisory } of commands) {
+			if (!runHasMjolnirCommand(command)) continue;
+			hasCandidate = true;
+			if (!advisory && workflowState === "active" && state === "active" && runHasScanGate(command)) hasGate = true;
+			else hasNonGatingCandidate = true;
+		}
+	}
+	return {
+		hasGate,
+		hasCandidate,
+		hasNonGatingCandidate
+	};
+}
+function detectCIWorkflows(root = ".") {
+	return CI_WORKFLOW_FILES.filter((workflow) => existsSync(join(root, workflow)));
+}
+function inspectWorkflow(content, workflowName) {
+	try {
+		if (workflowName === "Jenkinsfile") return {
+			name: workflowName,
+			status: "warn",
+			detail: "Jenkins pipeline detected; blocking scan verification is unsupported"
+		};
+		const analysis = workflowName.startsWith(".gitlab-ci.") ? analyzeGitlabWorkflow(content) : analyzeGithubWorkflow(content);
+		if (analysis.hasGate && !analysis.hasNonGatingCandidate) return {
+			name: workflowName,
+			status: "pass",
+			detail: "CI workflow contains a guaranteed blocking Mjölnir scan"
+		};
+		if (analysis.hasCandidate) return {
+			name: workflowName,
+			status: "fail",
+			detail: "Mjölnir command is disabled, conditional, or allowed to fail; no guaranteed blocking scan"
+		};
+	} catch (error) {
+		return {
+			name: workflowName,
+			status: "fail",
+			detail: `Invalid CI workflow YAML/provider: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+	return {
+		name: workflowName,
+		status: "warn",
+		detail: "No Mjölnir command detected in this CI workflow"
+	};
+}
+function checkSuppressionIntegrity(suppressions, findings, policy = DEFAULT_SUPPRESSION_POLICY, knownRuleIds, now = /* @__PURE__ */ new Date()) {
+	const result = computeSuppressionGovernanceGate(suppressions, findings, policy, knownRuleIds, now);
+	return result.passed ? {
+		name: "suppression-integrity",
+		status: "pass",
+		detail: `Suppression integrity passed: ${suppressions.length} suppression(s), ${findings.length} finding(s)`
+	} : {
+		name: "suppression-integrity",
+		status: "fail",
+		detail: result.policyViolations.join("; ")
+	};
+}
+function computeVerificationIntelligence(root = ".", suppressions = [], findings = [], policy = DEFAULT_SUPPRESSION_POLICY, knownRuleIds, now = /* @__PURE__ */ new Date()) {
+	const workflows = detectCIWorkflows(root);
+	const checks = [];
+	if (workflows.length === 0) checks.push({
+		name: "ci-workflow",
+		status: "fail",
+		detail: "No CI workflow files detected in repository"
+	});
+	else for (const workflow of workflows) try {
+		checks.push(inspectWorkflow(readFileSync(join(root, workflow), "utf8"), workflow));
+	} catch (error) {
+		checks.push({
+			name: workflow,
+			status: "fail",
+			detail: `Unable to read CI workflow: ${error instanceof Error ? error.message : String(error)}`
+		});
+	}
+	if (suppressions.length > 0) checks.push(checkSuppressionIntegrity(suppressions, findings, policy, knownRuleIds, now));
+	const passed = checks.filter((check) => check.status === "pass").length;
+	const failed = checks.filter((check) => check.status === "fail").length;
+	const warned = checks.filter((check) => check.status === "warn").length;
+	const overallStatus = failed > 0 ? "broken" : warned > 0 ? "degraded" : "healthy";
+	return {
+		workflow: workflows.length > 0 ? workflows.join(", ") : "none",
+		checks,
+		passed,
+		failed,
+		warned,
+		overallStatus
+	};
+}
+function renderCIIntegrityReport(report) {
+	const lines = [
+		"CI Workflow Integrity Report",
+		`Workflow: ${report.workflow}`,
+		`Status: ${report.overallStatus.toUpperCase()}`,
+		`Passed: ${report.passed}, Failed: ${report.failed}, Warned: ${report.warned}`,
+		""
+	];
+	for (const check of report.checks) {
+		const icon = check.status === "pass" ? "✓" : check.status === "fail" ? "✗" : "⚠";
+		lines.push(`${icon} ${check.name}: ${check.detail}`);
+	}
+	return lines.join("\n").trimEnd();
+}
+//#endregion
+//#region src/commands/milestone.ts
+const STRICT_SUPPRESSION_POLICY = {
+	...DEFAULT_SUPPRESSION_POLICY,
+	requireExpiration: true,
+	maxExpiredSuppressions: 0
+};
+function startsWithFlag(value) {
+	return value.charCodeAt(0) === 45;
+}
+function parseMilestoneArgs(argv, io) {
+	const args = {
+		target: ".",
+		json: false,
+		maxDurationMs: Number.POSITIVE_INFINITY
+	};
+	let targetSeen = false;
+	const value = (index, flag) => {
+		const candidate = argv[index];
+		if (candidate === void 0 || startsWithFlag(candidate)) {
+			io.err(`mjolnir: ${flag} requires a value`);
+			return null;
+		}
+		return candidate;
+	};
+	for (let index = 0; index < argv.length; index++) {
+		const token = argv[index] ?? "";
+		switch (token) {
+			case "--json":
+				args.json = true;
+				break;
+			case "--format": {
+				const format = value(++index, "--format");
+				if (format === null) return null;
+				if (format === "json") args.json = true;
+				else if (format !== "terminal") {
+					io.err("mjolnir: milestone commands support --format terminal|json");
+					return null;
+				}
+				break;
+			}
+			case "--no-progress": break;
+			case "--max-duration": {
+				const raw = value(++index, "--max-duration");
+				if (raw === null) return null;
+				const seconds = Number(raw);
+				if (!Number.isFinite(seconds) || seconds <= 0) {
+					io.err("mjolnir: --max-duration requires positive seconds");
+					return null;
+				}
+				args.maxDurationMs = seconds * 1e3;
+				break;
+			}
+			case "--framework": {
+				const framework = value(++index, "--framework");
+				if (framework === null) return null;
+				args.framework = framework;
+				break;
+			}
+			case "--policy": {
+				const policy = value(++index, "--policy");
+				if (policy === null) return null;
+				args.policy = policy;
+				break;
+			}
+			case "--history": {
+				const history = value(++index, "--history");
+				if (history === null) return null;
+				args.history = history;
+				break;
+			}
+			case "--recorded-at": {
+				const recordedAt = value(++index, "--recorded-at");
+				if (recordedAt === null || Number.isNaN(Date.parse(recordedAt))) {
+					io.err("mjolnir: --recorded-at requires an ISO-8601 timestamp");
+					return null;
+				}
+				args.recordedAt = recordedAt;
+				break;
+			}
+			case "--contract": {
+				const contract = value(++index, "--contract");
+				if (contract === null) return null;
+				args.contract = contract;
+				break;
+			}
+			case "--file": {
+				const file = value(++index, "--file");
+				if (file === null) return null;
+				args.file = file;
+				break;
+			}
+			case "--rule": {
+				const rule = value(++index, "--rule");
+				if (rule === null) return null;
+				args.rule = rule;
+				break;
+			}
+			default:
+				if (startsWithFlag(token)) {
+					io.err(`mjolnir: unknown milestone command flag "${token}"`);
+					return null;
+				}
+				if (targetSeen) {
+					io.err("mjolnir: milestone commands accept one target path");
+					return null;
+				}
+				args.target = token;
+				targetSeen = true;
+		}
+	}
+	return args;
+}
+function rejectUnexpectedOptions(args, allowed, io) {
+	const unexpected = [
+		"framework",
+		"policy",
+		"history",
+		"recordedAt",
+		"contract",
+		"file",
+		"rule"
+	].find((key) => args[key] !== void 0 && !allowed.has(key));
+	if (!unexpected) return false;
+	io.err(`mjolnir: option --${unexpected} is not valid for this command`);
+	return true;
+}
+function validateTarget(target, io) {
+	if (!existsSync(target)) {
+		io.err(`mjolnir: scan target does not exist: ${target}`);
+		return { code: 10 };
+	}
+	if (!statSync(target).isDirectory()) {
+		io.err(`mjolnir: scan target is not a directory: ${target}`);
+		return { code: 10 };
+	}
+	return { target };
+}
+function isWorkflowFile(path) {
+	const normalized = path.replaceAll("\\", "/");
+	return normalized.startsWith(".github/workflows/") || normalized === ".gitlab-ci.yml" || normalized === ".gitlab-ci.yaml" || basename(normalized) === "Jenkinsfile";
+}
+async function runMilestoneScan(args, io, readSources, strict = false) {
+	const target = resolve(args.target);
+	const valid = validateTarget(target, io);
+	if ("code" in valid) return valid;
+	let discovered = [];
+	let preSuppressionFindings = [];
+	const scanArgs = {
+		target,
+		json: false,
+		verbose: false,
+		maxDurationMs: args.maxDurationMs,
+		scopeChanged: false,
+		format: "terminal",
+		strict
+	};
+	const result = await runScan$1(scanArgs, {
+		onConfigWarning: (message) => io.err(message),
+		onGateNotice: (notice) => io.err(notice),
+		onTestFilesDiscovered: (files) => {
+			const contractPath = args.contract ? resolve(args.target, args.contract) : void 0;
+			if (contractPath) {
+				const mutable = files;
+				for (let index = mutable.length - 1; index >= 0; index--) {
+					const file = mutable[index];
+					if (file && (isAbsolute(file) ? resolve(file) : resolve(target, file)) === contractPath) mutable.splice(index, 1);
+				}
+			}
+			discovered = [...files];
+		},
+		onPreSuppressionFindings: (findings) => {
+			preSuppressionFindings = [...findings];
+		}
+	});
+	const files = [];
+	let readSkipped = 0;
+	if (readSources) {
+		const contractPath = args.contract ? resolve(args.target, args.contract) : void 0;
+		for (const file of discovered) {
+			const absoluteFile = isAbsolute(file) ? resolve(file) : resolve(target, file);
+			if (contractPath && absoluteFile === contractPath) continue;
+			const relativePath = relative(target, absoluteFile).replaceAll("\\", "/");
+			if (isWorkflowFile(relativePath)) continue;
+			try {
+				files.push({
+					path: relativePath,
+					text: readFileSync(absoluteFile, "utf8").replace(/^\uFEFF/, "")
+				});
+			} catch {
+				readSkipped++;
+			}
+		}
+		files.sort((left, right) => left.path.localeCompare(right.path));
+	}
+	return {
+		result,
+		preSuppressionFindings,
+		files,
+		readSkipped
+	};
+}
+function milestoneError(error, io, debug) {
+	if (error instanceof ConfigValidationError) {
+		io.err(error.message);
+		return 10;
+	}
+	internalErrorMessage(error, io.err, debug);
+	return 20;
+}
+function suppressionEntries(root) {
+	return loadSuppressions(root).entries.map((entry) => ({
+		ruleId: entry.ruleId,
+		reason: entry.reason,
+		...entry.files ? { files: entry.files } : {},
+		...entry.expires ? { expires: entry.expires } : {}
+	}));
+}
+function numericPolicyValue(record, key, fallback, integer) {
+	const value = record[key];
+	if (value === void 0) return fallback;
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || integer && !Number.isSafeInteger(value)) throw new ConfigValidationError(`suppression policy field ${key} must be a non-negative${integer ? " integer" : " number"}`);
+	return value;
+}
+function loadPolicy(path) {
+	if (!path) return STRICT_SUPPRESSION_POLICY;
+	let text;
+	try {
+		text = readFileSync(path, "utf8");
+	} catch (error) {
+		throw new ConfigValidationError(`unable to read suppression policy: ${path}`, { cause: error });
+	}
+	let record;
+	try {
+		record = parseJsonFile(text, path, isRecord$2);
+	} catch (error) {
+		throw new ConfigValidationError(`invalid suppression policy: ${path}`, { cause: error });
+	}
+	const requireExpiration = record.requireExpiration;
+	if (requireExpiration !== void 0 && typeof requireExpiration !== "boolean") throw new ConfigValidationError("suppression policy field requireExpiration must be boolean");
+	const allowedRuleIds = record.allowedRuleIds;
+	if (allowedRuleIds !== void 0 && (!Array.isArray(allowedRuleIds) || allowedRuleIds.some((ruleId) => typeof ruleId !== "string"))) throw new ConfigValidationError("suppression policy field allowedRuleIds must be a string array");
+	const maxMassSuppressionRatio = numericPolicyValue(record, "maxMassSuppressionRatio", DEFAULT_SUPPRESSION_POLICY.maxMassSuppressionRatio, false);
+	if (maxMassSuppressionRatio > 1) throw new ConfigValidationError("suppression policy field maxMassSuppressionRatio must be between 0 and 1");
+	return {
+		requireExpiration: requireExpiration ?? DEFAULT_SUPPRESSION_POLICY.requireExpiration,
+		allowedRuleIds: allowedRuleIds ?? [],
+		maxTotalSuppressions: numericPolicyValue(record, "maxTotalSuppressions", DEFAULT_SUPPRESSION_POLICY.maxTotalSuppressions, true),
+		maxExpiredSuppressions: numericPolicyValue(record, "maxExpiredSuppressions", DEFAULT_SUPPRESSION_POLICY.maxExpiredSuppressions, true),
+		maxMassSuppressionRatio
+	};
+}
+function isTrustSnapshot(value) {
+	return isRecord$2(value) && typeof value.scanId === "string" && typeof value.timestamp === "string" && (typeof value.score === "number" || value.score === null) && typeof value.findings === "number" && typeof value.errors === "number" && typeof value.warnings === "number" && typeof value.infos === "number" && typeof value.advisory === "number" && typeof value.trustLevel === "string" && typeof value.confidence === "number" && typeof value.evidenceCoverage === "number" && typeof value.inconclusiveRate === "number" && typeof value.partial === "boolean" && typeof value.frameworkCount === "number" && typeof value.ruleCount === "number";
+}
+function loadTrustHistory(path) {
+	if (!existsSync(path)) return [];
+	try {
+		const text = readFileSync(path, "utf8");
+		return parseJsonFile(text, path, (candidate) => {
+			return Array.isArray(candidate) && candidate.every((entry) => isTrustSnapshot(entry));
+		});
+	} catch (error) {
+		throw new ConfigValidationError(`invalid trust history: ${path}`, { cause: error });
+	}
+}
+function isFiniteNumber(value) {
+	return typeof value === "number" && Number.isFinite(value);
+}
+function isNonNegativeInteger(value) {
+	return Number.isSafeInteger(value) && value >= 0;
+}
+function isPositiveInteger(value) {
+	return Number.isSafeInteger(value) && value > 0;
+}
+function isStringArray(value) {
+	return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+function isValidAnalysisStatus(value) {
+	if (!isRecord$2(value)) return false;
+	return (value.discovery === "complete" || value.discovery === "partial") && (value.rules === "complete" || value.rules === "partial") && isNonNegativeInteger(value.skippedFiles) && isFiniteNumber(value.durationMs) && value.durationMs >= 0 && (value.truncationReasons === void 0 || isStringArray(value.truncationReasons)) && (value.rulesCrashed === void 0 || isNonNegativeInteger(value.rulesCrashed));
+}
+function isValidDimension(value) {
+	return isRecord$2(value) && typeof value.category === "string" && isFiniteNumber(value.score) && value.score >= 0 && value.score <= 100 && isNonNegativeInteger(value.errors) && isNonNegativeInteger(value.warnings) && isNonNegativeInteger(value.infos);
+}
+function isValidFinding(value) {
+	if (!isRecord$2(value)) return false;
+	return typeof value.ruleId === "string" && value.ruleId.length > 0 && typeof value.category === "string" && typeof value.file === "string" && value.file.length > 0 && isPositiveInteger(value.line) && isPositiveInteger(value.column) && typeof value.message === "string" && value.message.length > 0 && typeof value.severity === "string" && typeof value.confidence === "string" && typeof value.findingType === "string" && typeof value.qaImpact === "string" && typeof value.why === "string" && typeof value.fix === "string";
+}
+function isValidTrustSummary(value) {
+	if (!isRecord$2(value)) return false;
+	return [
+		"L0",
+		"L1",
+		"L2",
+		"L3",
+		"L4",
+		"L5"
+	].includes(String(value.level)) && isFiniteNumber(value.confidence) && value.confidence >= 0 && value.confidence <= 1 && isFiniteNumber(value.evidenceCoverage) && value.evidenceCoverage >= 0 && value.evidenceCoverage <= 1 && isFiniteNumber(value.inconclusiveRate) && value.inconclusiveRate >= 0 && value.inconclusiveRate <= 1 && (value.measuredFpOfFiredRules === void 0 || isFiniteNumber(value.measuredFpOfFiredRules) && value.measuredFpOfFiredRules >= 0 && value.measuredFpOfFiredRules <= 1) && isStringArray(value.provisionalRuleIds) && (value.confidenceCeiling === void 0 || isFiniteNumber(value.confidenceCeiling) && value.confidenceCeiling >= 0 && value.confidenceCeiling <= 1) && isStringArray(value.ceilingReasons);
+}
+function isValidProvenance(value) {
+	if (!isRecord$2(value)) return false;
+	return isNonNegativeInteger(value.testFiles) && isNonNegativeInteger(value.generatedMarkedFiles) && isNonNegativeInteger(value.codegenLikeFiles) && isFiniteNumber(value.shareMarkedGenerated) && value.shareMarkedGenerated >= 0 && value.shareMarkedGenerated <= 1 && isNonNegativeInteger(value.findingsInGeneratedFiles) && isNonNegativeInteger(value.findingsInUnmarkedFiles) && typeof value.note === "string";
+}
+function isValidForensicVerdicts(value) {
+	if (!isRecord$2(value) || !isRecord$2(value.byVerdict)) return false;
+	return isNonNegativeInteger(value.classifications) && isNonNegativeInteger(value.inconclusive) && Object.values(value.byVerdict).every((count) => isNonNegativeInteger(count));
+}
+function isValidSummary(value) {
+	if (!isRecord$2(value)) return false;
+	return typeof value.digest === "string" && value.digest.length > 0 && isNonNegativeInteger(value.findings) && (value.score === null || isFiniteNumber(value.score) && value.score >= 0 && value.score <= 100) && isNonNegativeInteger(value.errors) && isNonNegativeInteger(value.warnings) && isNonNegativeInteger(value.infos) && isNonNegativeInteger(value.advisory);
+}
+function isValidAnnotation(value) {
+	if (!isRecord$2(value)) return false;
+	return typeof value.path === "string" && value.path.length > 0 && isPositiveInteger(value.start_line) && (value.annotation_level === "failure" || value.annotation_level === "warning" || value.annotation_level === "notice") && typeof value.message === "string" && typeof value.ruleId === "string" && value.ruleId.length > 0 && (value.detectorRevision === void 0 || isPositiveInteger(value.detectorRevision)) && typeof value.advisory === "boolean";
+}
+function isValidCompleteness(value) {
+	if (!isRecord$2(value)) return false;
+	return typeof value.partial === "boolean" && (value.discovery === "complete" || value.discovery === "partial") && (value.rules === "complete" || value.rules === "partial") && isNonNegativeInteger(value.skippedFiles) && isNonNegativeInteger(value.rulesCrashed) && isStringArray(value.truncationReasons) && typeof value.frameworkDetectionUnknown === "boolean" && isFiniteNumber(value.durationMs) && value.durationMs >= 0;
+}
+function isValidContract(value) {
+	if (!isRecord$2(value)) return false;
+	return Number.isSafeInteger(value.contractVersion) && isValidSummary(value.summary) && Array.isArray(value.annotations) && value.annotations.length <= 50 && value.annotations.every((annotation) => isValidAnnotation(annotation)) && typeof value.annotationsTruncated === "boolean" && isValidCompleteness(value.completeness) && (value.trustSummary === void 0 || isValidTrustSummary(value.trustSummary)) && (value.provenance === void 0 || isValidProvenance(value.provenance)) && (value.forensicVerdicts === void 0 || isValidForensicVerdicts(value.forensicVerdicts));
+}
+function isScanResultDocument(value) {
+	if (!isRecord$2(value) || value.schemaVersion !== 1) return false;
+	return (value.score === null || isFiniteNumber(value.score) && value.score >= 0 && value.score <= 100) && typeof value.partial === "boolean" && isStringArray(value.frameworks) && Array.isArray(value.dimensions) && value.dimensions.every((dimension) => isValidDimension(dimension)) && Array.isArray(value.findings) && value.findings.every((finding) => isValidFinding(finding)) && isValidAnalysisStatus(value.analysisStatus) && (value.agenticProfile === void 0 || isValidProvenance(value.agenticProfile)) && (value.trustSummary === void 0 || isValidTrustSummary(value.trustSummary)) && (value.forensicVerdicts === void 0 || isValidForensicVerdicts(value.forensicVerdicts)) && isValidContract(value.contract);
+}
+function emitVerification(verification, json, io) {
+	if (json) io.out(JSON.stringify(verification, null, 2));
+	else io.out(renderContractVerification(verification));
+}
+function cloneContract(contract) {
+	return JSON.parse(JSON.stringify(contract));
+}
+function verifyPersistedContract(document, freshResult) {
+	const artifactVerification = verifyMachineContract(document, document.contract);
+	const freshComparable = cloneContract(document.contract);
+	const expected = buildMachineContract(freshResult);
+	freshComparable.completeness.durationMs = expected.completeness.durationMs;
+	const freshVerification = verifyMachineContract(freshResult, freshComparable);
+	const violations = [...artifactVerification.violations, ...freshVerification.violations].filter((value, index, all) => all.indexOf(value) === index);
+	if (!freshVerification.passed) violations.push("Persisted contract is not bound to a fresh scan");
+	if (!artifactVerification.passed) violations.push("Persisted scan result is not consistent with its contract");
+	const checks = [
+		...artifactVerification.checks,
+		...freshVerification.checks,
+		{
+			name: "fresh-scan-binding",
+			status: freshVerification.passed && artifactVerification.passed ? "pass" : "fail",
+			detail: freshVerification.passed && artifactVerification.passed ? "Contract matches an independent fresh scan" : "Contract is not bound to the current scan"
+		}
+	];
+	return {
+		...freshVerification,
+		passed: violations.length === 0,
+		violations: violations.filter((value, index, all) => all.indexOf(value) === index),
+		checks,
+		freshScanMatch: freshVerification.passed,
+		artifactResultMatch: artifactVerification.passed
+	};
+}
+function runFrameworkMaturityCommand(argv, io = {
+	out,
+	err
+}) {
+	const args = parseMilestoneArgs(argv, io);
+	if (!args) return 10;
+	if (rejectUnexpectedOptions(args, /* @__PURE__ */ new Set(["framework"]), io)) return 10;
+	const selected = args.framework ? getFrameworkMaturity(args.framework) : void 0;
+	if (args.framework && !selected) {
+		io.err(`mjolnir: unknown framework "${args.framework}"`);
+		return 10;
+	}
+	const frameworks = selected ? [selected] : getAllFrameworkMaturity();
+	if (args.json) io.out(JSON.stringify({
+		calibrationAuthority: "human",
+		automatedClosureAllowed: false,
+		frameworks
+	}, null, 2));
+	else if (selected?.frameworkId === "playwright") io.out(`Calibration authority: human; automated closure is not permitted.\n${renderPlaywrightMaturityReport(getPlaywrightMaturityReport())}`);
+	else {
+		io.out("Calibration authority: human; automated closure is not permitted.");
+		for (const framework of frameworks) io.out(`${framework.frameworkId}: ${framework.currentMaturity} → ${framework.targetMaturity} (${framework.maturityScore}/100)`);
+	}
+	return 0;
+}
+async function runSuppressionGateCommand(argv, io = {
+	out,
+	err
+}) {
+	const args = parseMilestoneArgs(argv, io);
+	if (!args) return 10;
+	if (rejectUnexpectedOptions(args, /* @__PURE__ */ new Set(["policy"]), io)) return 10;
+	try {
+		const scan = await runMilestoneScan(args, io, false, true);
+		if ("code" in scan) return scan.code;
+		const target = resolve(args.target);
+		const gate = computeSuppressionGovernanceGate(suppressionEntries(target), scan.preSuppressionFindings, loadPolicy(args.policy ? resolve(target, args.policy) : void 0), new Set(KNOWN_RULE_IDS$1), /* @__PURE__ */ new Date());
+		if (args.json) io.out(JSON.stringify(gate, null, 2));
+		else io.out(renderSuppressionGovernanceResult(gate));
+		if (scan.result.partial) return 2;
+		return gate.passed ? 0 : 1;
+	} catch (error) {
+		return milestoneError(error, io, argv.includes("--debug"));
+	}
+}
+async function runCrossFileCommand(argv, io = {
+	out,
+	err
+}) {
+	const args = parseMilestoneArgs(argv, io);
+	if (!args) return 10;
+	if (rejectUnexpectedOptions(args, /* @__PURE__ */ new Set(), io)) return 10;
+	try {
+		const scan = await runMilestoneScan(args, io, true);
+		if ("code" in scan) return scan.code;
+		const analysis = analyzeCrossFileSignals(scan.files, scan.result.findings, resolve(args.target));
+		if (args.json) io.out(JSON.stringify(analysis, null, 2));
+		else io.out(renderCrossFileAnalysis(analysis));
+		if (scan.result.partial || scan.readSkipped > 0 || scan.files.length === 0) return 2;
+		return analysis.signals.length > 0 ? 1 : 0;
+	} catch (error) {
+		return milestoneError(error, io, argv.includes("--debug"));
+	}
+}
+async function runContractVerifyCommand(argv, io = {
+	out,
+	err
+}) {
+	const args = parseMilestoneArgs(argv, io);
+	if (!args) return 10;
+	if (rejectUnexpectedOptions(args, /* @__PURE__ */ new Set(["contract"]), io)) return 10;
+	try {
+		if (args.contract) {
+			const target = resolve(args.target);
+			const valid = validateTarget(target, io);
+			if ("code" in valid) return valid.code;
+			const path = resolve(target, args.contract);
+			let document;
+			try {
+				document = parseJsonFile(readFileSync(path, "utf8"), path, isScanResultDocument);
+			} catch (error) {
+				throw new ConfigValidationError(`invalid contract document: ${path}`, { cause: error });
+			}
+			const relativePath = relative(target, path).replaceAll("\\", "/");
+			const hiddenDirectory = relativePath !== "" && !relativePath.startsWith("../") && !isAbsolute(relativePath) && existsSync(path) ? mkdtempSync(join(tmpdir(), "mjolnir-contract-")) : void 0;
+			const hiddenPath = hiddenDirectory ? join(hiddenDirectory, basename(path)) : void 0;
+			if (hiddenPath) renameSync(path, hiddenPath);
+			let fresh;
+			try {
+				fresh = await runMilestoneScan(args, io, false);
+			} finally {
+				if (hiddenPath && existsSync(hiddenPath)) renameSync(hiddenPath, path);
+				if (hiddenDirectory) rmSync(hiddenDirectory, {
+					recursive: true,
+					force: true
+				});
+			}
+			if ("code" in fresh) return fresh.code;
+			const verification = verifyPersistedContract(document, fresh.result);
+			emitVerification(verification, args.json, io);
+			if (!verification.passed) return 1;
+			if (document.partial || fresh.result.partial) return 2;
+			return 0;
+		}
+		const scan = await runMilestoneScan(args, io, false);
+		if ("code" in scan) return scan.code;
+		const verification = verifyMachineContract(scan.result, buildMachineContract(scan.result));
+		emitVerification(verification, args.json, io);
+		if (scan.result.partial) return 2;
+		return verification.passed ? 0 : 1;
+	} catch (error) {
+		return milestoneError(error, io, argv.includes("--debug"));
+	}
+}
+async function runTrustTrendCommand(argv, io = {
+	out,
+	err
+}) {
+	const args = parseMilestoneArgs(argv, io);
+	if (!args) return 10;
+	if (rejectUnexpectedOptions(args, /* @__PURE__ */ new Set(["history", "recordedAt"]), io)) return 10;
+	try {
+		const scan = await runMilestoneScan(args, io, false);
+		if ("code" in scan) return scan.code;
+		if (!scan.result.runIdentity || !scan.result.trustSummary) {
+			if (args.json) io.out(JSON.stringify({ error: "trust_inputs_unavailable" }, null, 2));
+			else io.err("mjolnir: scan did not produce run identity and trust summary");
+			return 2;
+		}
+		const target = resolve(args.target);
+		const historyPath = resolve(target, args.history ?? join(".mjolnir", "trust-history.json"));
+		const history = loadTrustHistory(historyPath);
+		const snapshot = computeTrustSnapshot(scan.result, scan.result.runIdentity, scan.result.trustSummary, args.recordedAt ?? (/* @__PURE__ */ new Date()).toISOString());
+		const merged = new Map(history.map((entry) => [`${entry.scanId}\u0000${entry.timestamp}`, entry]));
+		merged.set(`${snapshot.scanId}\u0000${snapshot.timestamp}`, snapshot);
+		const snapshots = [...merged.values()].sort((left, right) => left.timestamp.localeCompare(right.timestamp) || left.scanId.localeCompare(right.scanId));
+		writeFileAtomic(historyPath, `${JSON.stringify(snapshots, null, 2)}\n`);
+		const trend = analyzeTrustTrends(snapshots);
+		if (args.json) io.out(JSON.stringify(trend, null, 2));
+		else io.out(renderTrustTrend(trend));
+		return scan.result.partial ? 2 : 0;
+	} catch (error) {
+		return milestoneError(error, io, argv.includes("--debug"));
+	}
+}
+async function runEvidenceGraphCommand(argv, io = {
+	out,
+	err
+}) {
+	const args = parseMilestoneArgs(argv, io);
+	if (!args) return 10;
+	if (rejectUnexpectedOptions(args, /* @__PURE__ */ new Set(["file", "rule"]), io)) return 10;
+	if (args.file && args.rule) {
+		io.err("mjolnir: evidence-graph accepts --file or --rule, not both");
+		return 10;
+	}
+	try {
+		const scan = await runMilestoneScan(args, io, true);
+		if ("code" in scan) return scan.code;
+		if (!scan.result.runIdentity) {
+			if (args.json) io.out(JSON.stringify({ error: "run_identity_unavailable" }, null, 2));
+			else io.err("mjolnir: scan did not produce a run identity");
+			return 2;
+		}
+		const graph = buildEvidenceGraphFromScan(scan.result, scan.result.runIdentity, scan.files);
+		if (args.file || args.rule) {
+			const findings = args.file ? queryFindingsByFile(scan.result, args.file) : queryFindingsByRule(scan.result, args.rule ?? "");
+			if (args.json) io.out(JSON.stringify({ findings }, null, 2));
+			else io.out(findings.length === 0 ? "No matching findings." : findings.map((finding) => `${finding.ruleId} ${finding.file}:${finding.line}`).join("\n"));
+			return scan.result.partial ? 2 : 0;
+		}
+		if (args.json) io.out(JSON.stringify(graph, null, 2));
+		else io.out(renderEvidenceGraphResult(graph));
+		return scan.result.partial || scan.readSkipped > 0 || scan.files.length === 0 ? 2 : 0;
+	} catch (error) {
+		return milestoneError(error, io, argv.includes("--debug"));
+	}
+}
+async function runCIIntegrityCommand(argv, io = {
+	out,
+	err
+}) {
+	const args = parseMilestoneArgs(argv, io);
+	if (!args) return 10;
+	if (rejectUnexpectedOptions(args, /* @__PURE__ */ new Set(["policy"]), io)) return 10;
+	try {
+		const scan = await runMilestoneScan(args, io, false);
+		if ("code" in scan) return scan.code;
+		const target = resolve(args.target);
+		const report = computeVerificationIntelligence(target, suppressionEntries(target), scan.preSuppressionFindings, loadPolicy(args.policy ? resolve(target, args.policy) : void 0), new Set(KNOWN_RULE_IDS$1), /* @__PURE__ */ new Date());
+		if (args.json) io.out(JSON.stringify(report, null, 2));
+		else io.out(renderCIIntegrityReport(report));
+		if (scan.result.partial) return 2;
+		return report.failed > 0 || report.warned > 0 ? 1 : 0;
+	} catch (error) {
+		return milestoneError(error, io, argv.includes("--debug"));
+	}
+}
+//#endregion
+//#region src/cli.ts
+/**
+* Mjölnir CLI entry point (W1-02).
+* Exit codes (§24.1, frozen): 0 clean · 1 findings ≥ gate · 2 partial ·
+* 10 usage error · 20 internal error.
+*/
+/**
+* Tool version for `mjolnir --version`.
+*
+* A literal, not a package.json read: the shipped artifact is a single
+* bundled `dist/cli.mjs`, so resolving package.json at runtime depends on
+* where the file happens to sit after install. This follows the same
+* discipline as SARIF's `driver.version` — kept in sync by
+* `scripts/sync-sarif-version.cjs` on release and guarded by
+* `tests/version-consistency.spec.ts` locally. R4c moved the literal to
+* src/engine/version.ts (a leaf module) so the scan pipeline's run
+* identity can carry it without a cli.ts import cycle; this re-export
+* keeps every existing consumer stable.
+*/
+const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isValidFindingRecord, discoverAndParseRuntimeReport, KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID, EVIDENCE_OVERRIDES, SUITE_INVALIDATING_RULE_IDS } = scan_pipeline_exports;
+function parseArgs(argv, onError) {
+	const args = {
+		target: ".",
+		json: false,
+		verbose: false,
+		maxDurationMs: Number.POSITIVE_INFINITY,
+		scopeChanged: false,
+		format: "terminal"
+	};
+	const reject = (detail) => {
+		onError?.(detail);
+		return null;
+	};
+	for (let i = 0; i < argv.length; i++) {
+		const a = argv[i] ?? "";
+		if (a === "--json") {
+			args.json = true;
+			args.format = "json";
+		} else if (a === "--format") {
+			const fmt = argv[++i];
+			if (fmt === void 0) return reject({
+				flag: "--format",
+				token: "(missing)"
+			});
+			if (fmt === "sarif") args.format = "sarif";
+			else if (fmt === "mermaid") args.format = "mermaid";
+			else if (fmt === "codequality") args.format = "codequality";
+			else if (fmt === "json") {
+				args.format = "json";
+				args.json = true;
+			} else if (fmt !== "terminal") return reject({
+				flag: "--format",
+				token: fmt
+			});
+		} else if (a === "--verbose") args.verbose = true;
+		else if (a === "--scope") {
+			const mode = argv[++i];
+			if (mode === "changed") args.scopeChanged = true;
+			else return reject({
+				flag: "--scope",
+				token: mode
+			});
+		} else if (a === "--base") {
+			const ref = argv[++i];
+			if (!ref || ref.startsWith("-")) return reject({
+				flag: "--base",
+				token: ref
+			});
+			args.base = ref;
+		} else if (a === "--max-duration") {
+			const v = Number(argv[++i]);
+			if (!Number.isFinite(v) || v <= 0) return reject({
+				flag: "--max-duration",
+				token: argv[i]
+			});
+			args.maxDurationMs = v * 1e3;
+		} else if (a === "--width") {
 			const v = Number(argv[++i]);
 			if (!Number.isFinite(v) || v <= 0) return reject({
 				flag: "--width",
@@ -11284,10 +14807,23 @@ function parseArgsOrUsage(argv, io) {
 		reported = true;
 		io.err(usageErrorMessage(detail));
 	});
-	if (!args && !reported) printUsage(io.out);
+	if (!args && !reported) printUsage(io.out, resolveHelpWidth(argv));
 	return args;
 }
 /**
+* Resolves the effective terminal width for help rendering. Scans the
+* raw argv for `--width <cols>` (the help path runs before full arg
+* parsing, so we read it directly); falls back to the detected TTY
+* column width, then the default help width of 88.
+*/
+function resolveHelpWidth(argv) {
+	for (let i = 0; i < argv.length; i++) if (argv[i] === "--width") {
+		const v = Number(argv[i + 1]);
+		if (Number.isFinite(v)) return Math.max(1, Math.floor(v));
+	}
+	return process$1.stdout.columns ?? 88;
+}
+/**
 * Audit H-4 (extended to every scanning subcommand): a nonexistent or
 * non-directory target is a usage error — a typo'd CI path must be a
 * loud red, never a silent green. Returns the exit code (10) or null
@@ -11345,7 +14881,8 @@ function runCiInstall(argv, io = {
 		io.err("Unknown gate level. Use: advisory | error | warning");
 		return 10;
 	}
-	const result = ciInstall(resolve("."), gateArg ?? "error", {
+	const gate = gateArg ?? "advisory";
+	const result = ciInstall(resolve("."), gate, {
 		force,
 		action: !noAction
 	});
@@ -11357,7 +14894,8 @@ function runCiInstall(argv, io = {
 		return 10;
 	}
 	io.out(`${result.existed ? "Updated" : "Created"} ${result.written}`);
-	io.out(noAction ? "Plain-npx template (—no-action). Default mode: blocking — findings at the gate fail the job." : "Action-based template: uses Sergey-Bar/Mjolnir@4a588bc62d517bc85fc44c0eae64c6587d3bf70b0 (immutable pin).");
+	io.out(noAction ? `Plain-npx template (--no-action). Gate: ${gate}.` : `Action-based template: uses Sergey-Bar/Mjolnir@4a588bc62d517bc85fc44c0eae64c6587d3bf70b0 (immutable pin). Gate: ${gate}.`);
+	io.out(gate === "advisory" ? "Advisory mode reports findings without blocking. Opt in with --gate error or --gate warning." : `Blocking mode fails on ${gate} findings.`);
 	io.out("Change with: mjolnir ci install --gate error|warning|advisory");
 	if (!noAction) io.out("Prefer the plain-npx workflow? Re-run with --no-action.");
 	return 0;
@@ -11382,44 +14920,9 @@ function runSuppressions(io = { out }) {
 * nor an existing path is a TYPO, and a typo must not silently fall
 * through to a scan of whatever the remaining arguments parse to.
 */
-const SUBCOMMANDS = /* @__PURE__ */ new Set([
-	"scan",
-	"ci",
-	"suppressions",
-	"forensics",
-	"triage",
-	"badge",
-	"trust-report",
-	"debt",
-	"impact",
-	"baseline",
-	"report",
-	"policy",
-	"quarantine",
-	"analyze",
-	"ci-adapter",
-	"dashboard",
-	"enterprise",
-	"maturity",
-	"diff",
-	"pr-comment",
-	"stats",
-	"fix",
-	"create-rule",
-	"handover",
-	"init",
-	"pw-report",
-	"doctor",
-	"rules",
-	"explain",
-	"release-trust",
-	"doctor:playwright",
-	"mcp",
-	"business-case",
-	"release-report"
-]);
-function printUsage(print) {
-	print(renderRootHelp());
+const SUBCOMMANDS = new Set(CLI_COMMAND_NAMES);
+function printUsage(print, width = 88) {
+	print(renderRootHelp(1, { width }));
 }
 async function main(argv = process$1.argv.slice(2), io = {
 	out,
@@ -11473,7 +14976,14 @@ async function main(argv = process$1.argv.slice(2), io = {
 		"doctor:playwright": (a, o) => runDoctorPlaywright(a, o),
 		why: (a, o) => runWhyCommand(a, o),
 		handoff: (a, o) => runHandoffCommand(a, o),
-		install: (a, o) => runInstallCommand(a, o)
+		install: (a, o) => runInstallCommand(a, o),
+		"ci-integrity": (a, o) => runCIIntegrityCommand(a, o),
+		"framework-maturity": (a, o) => runFrameworkMaturityCommand(a, o),
+		"suppression-gate": (a, o) => runSuppressionGateCommand(a, o),
+		"cross-file": (a, o) => runCrossFileCommand(a, o),
+		"contract-verify": (a, o) => runContractVerifyCommand(a, o),
+		"trust-trend": (a, o) => runTrustTrendCommand(a, o),
+		"evidence-graph": (a, o) => runEvidenceGraphCommand(a, o)
 	};
 	const verb = argv[0] ?? "";
 	const handler = Object.hasOwn(VERBS, verb) ? VERBS[verb] : void 0;
@@ -11485,7 +14995,7 @@ async function main(argv = process$1.argv.slice(2), io = {
 	if (argv[0] === "help") return runHelpCommand(argv.slice(1), io);
 	if (SUBCOMMANDS.has(argv[0] ?? "")) {
 		io.err(`mjolnir: incomplete or unknown subcommand "${argv[0]}".`);
-		printUsage(io.out);
+		printUsage(io.out, resolveHelpWidth(argv));
 		return 10;
 	}
 	if (argv[0] !== void 0 && argv[0].length > 0 && !argv[0].startsWith("-") && !existsSync(argv[0]) && argv[0].match(/^[a-z][\w:-]*$/i) !== null) {
@@ -11506,18 +15016,19 @@ function runHelpCommand(argv, io = {
 	err
 }) {
 	const tokens = argv.filter((a) => !a.startsWith("-"));
+	const helpWidth = resolveHelpWidth(argv);
 	if (tokens.length >= 2) {
 		const joined = `${tokens[0]} ${tokens[1]}`;
 		if (hasVerbHelp(joined)) {
-			io.out(renderVerbHelp(joined));
+			io.out(renderVerbHelp(joined, { width: helpWidth }));
 			return 0;
 		}
 	}
 	if (tokens.length > 0) {
-		io.out(renderVerbHelp(tokens[0]));
+		io.out(renderVerbHelp(tokens[0], { width: helpWidth }));
 		return 0;
 	}
-	io.out(renderRootHelp(1));
+	io.out(renderRootHelp(1, { width: helpWidth }));
 	return 0;
 }
 function isEntryPoint() {
@@ -11536,4 +15047,4 @@ if (isEntryPoint()) try {
 	process$1.exitCode = 20;
 }
 //#endregion
-export { ENGINE_VERSION as CLI_VERSION, EVIDENCE_OVERRIDES, KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID, SUITE_INVALIDATING_RULE_IDS, buildUniversalRules, discoverAndParseRuntimeReport, err, exitForFindings, fallbackWorkspace, internalErrorMessage, isEntryPoint, isValidFindingRecord, levenshtein, main, nearestFlags, out, parseArgs, parseArgsOrUsage, pathMatchesGlob, printUsage, renderScanOutput, runAnalyzeCommand, runBadgeCommand, runBaselineCommand, runBusinessCaseCommand, runCiAdapterCommand, runCiInstall, runCreateRuleCommand, runDashboardCommand, runDebtCommand, runDiffCommand, runDoctorCommand, runDoctorPlaywright, runEnterpriseCommand, runExecReportCommand, runExplainCommand, runFixCommand, runForensicsCommand, runHandoffCommand, runHandoverCommand, runHelpCommand, runImpactCommand, runInitCommand, runInstallCommand, runMaturityCommand, runMutationCommand, runPolicyCommand, runPrCommentCommand, runPwReportCommand, runQuarantineCommand, runReleaseReportCommand, runReleaseTrustCommand, runReportPlaywrightCommand, runRulesCommand, runScan, runScanCommand, runStatsCommand, runSummaryCommand, runSuppressions, runTrendCommand, runTriageCommand, runTrustReportCommand, runVerifyCommand, runWhyCommand, usageErrorMessage, validateScanTarget };
+export { ENGINE_VERSION as CLI_VERSION, EVIDENCE_OVERRIDES, KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID, SUITE_INVALIDATING_RULE_IDS, buildUniversalRules, discoverAndParseRuntimeReport, err, exitForFindings, fallbackWorkspace, internalErrorMessage, isEntryPoint, isValidFindingRecord, levenshtein, main, nearestFlags, out, parseArgs, parseArgsOrUsage, pathMatchesGlob, printUsage, renderScanOutput, runAnalyzeCommand, runBadgeCommand, runBaselineCommand, runBusinessCaseCommand, runCIIntegrityCommand, runCiAdapterCommand, runCiInstall, runContractVerifyCommand, runCreateRuleCommand, runCrossFileCommand, runDashboardCommand, runDebtCommand, runDiffCommand, runDoctorCommand, runDoctorPlaywright, runEnterpriseCommand, runEvidenceGraphCommand, runExecReportCommand, runExplainCommand, runFixCommand, runForensicsCommand, runFrameworkMaturityCommand, runHandoffCommand, runHandoverCommand, runHelpCommand, runImpactCommand, runInitCommand, runInstallCommand, runMaturityCommand, runMutationCommand, runPolicyCommand, runPrCommentCommand, runPwReportCommand, runQuarantineCommand, runReleaseReportCommand, runReleaseTrustCommand, runReportPlaywrightCommand, runRulesCommand, runScan, runScanCommand, runStatsCommand, runSummaryCommand, runSuppressionGateCommand, runSuppressions, runTrendCommand, runTriageCommand, runTrustReportCommand, runTrustTrendCommand, runVerifyCommand, runWhyCommand, usageErrorMessage, validateScanTarget };