mjolnir-qa 2.1.0 → 3.0.0

package/CHANGELOG.md

@@ -11,6 +11,60 @@ once shipped, so this file is the record of what changed between versions.
 
 ## [Unreleased]
 
+### Changed
+
+- **Advisory-first CI adoption** — `mjolnir ci install` and the root
+  GitHub Action now default to non-blocking findings and non-blocking partial
+  scans. Blocking remains explicit through `--gate error`, `--gate warning`,
+  or `fail-on`.
+- Suppression counts now report matched findings, not configured entries;
+  `suppression-gate` evaluates all-tier pre-suppression findings and enforces
+  total-count limits.
+- Zero-finding reports no longer claim the suite is clean or that CI is green.
+
+### Added
+
+- **Zero-touch PR framework** — Conventional Commits enforcement via
+  `commitlint` + `.husky/commit-msg` (scope is mandatory; WIP/fixup/squash
+  commits are rejected before they reach the object store); pinned-seed
+  property tests (`vitest.property.config.ts`, `tests/scope/property-invariants.spec.ts`
+  with a shared `SEED` constant so failures are reproducible); the
+  `merge-verify` CI job that runs the full gate on the **merge result**,
+  not the PR head, so a green PR that merges into a red `main` is visible
+  before it ships; and `scripts/check-ci-local-parity.mjs`, which keeps
+  `ci.yml`, `merge-verify.yml` and the local gate exercising the same
+  command list. All additive — no frozen surface changed.
+
+## [3.0.0] — 2026-09-24
+
+### Breaking changes
+
+- Trust and execution boundaries are now explicit and bounded. JavaScript/local-rule execution requires the plugin trust gate; output writers reject symlink/traversal targets; JSON, file, cache, and runtime inputs have size budgets; CLI/MCP durations are finite.
+- Saved report and machine-contract consumers now receive completion, scope, evidence, and verdict fields. Incomplete, L0/zero-evidence, and partial states cannot be presented as `WORTHY`.
+- Privileged PR publication is split into a read-only scan job and an artifact-only publisher with commit-bound, paginated `mjolnir-report:v2` upserts.
+
+### Added
+
+- Enterprise threat-model and data-flow artifacts with a strict validator, claim registry with implementation/test/authority/expiry evidence, and a candidate trust manifest/readiness gate.
+- Canonical completion derivation, bounded cache/artifact persistence, run-identity tree binding, same-process concurrency evidence, and deterministic source-scoped self-scan/replay gates.
+- Public-output redaction/escaping across trust reports, job summaries, dashboards, triage, and Playwright reports; atomic artifact writes and release-mode retention controls.
+
+### Fixed
+
+- Cross-platform CI matrix coverage for Node 22/24 and Linux/macOS/Windows, including clean-checkout candidate-manifest hashing and deterministic self-scans.
+- Partial/degraded scope accounting now distinguishes intentionally excluded fixtures from missed test-like files and propagates reasons through CLI, reports, and machine contracts.
+- Generated blast-radius, demo/video, site, and release evidence is refreshed from the current tree.
+
+### Migration
+
+- Install `mjolnir-qa@3.0.0` with Node.js `>=22.18`.
+- Use the `@v3` consumer tag after the stable release; use an exact `v3.0.0` tag for reproducible enforcement.
+- Review the new `--enable-plugins` gate, finite `--max-duration` budget, report completion fields, and strict artifact path requirements.
+
+### Certification boundary
+
+This release is software-complete and locally certified for the declared engineering gates. Trust certification remains `NOT_CERTIFIED` until protected holdout, real-world, platform/consumer, and human authority evidence is supplied.
+
 ## [2.1.0] — 2026-09-24
 
 ### Added

package/dist/cli.d.mts

@@ -325,12 +325,15 @@ interface ScanResult {
      * truncation actually happened — absence means the scan is whole.
      */
     truncationReasons?: string[];
+    /** Canonical completion reasons, including scope and parser degradation. */
+    reasons?: string[];
     /**
      * Rule executions that threw and were swallowed by crash isolation
      * (audit R-9). 0 means no rule silently failed; absence means the
      * producer predates the counter.
      */
     rulesCrashed?: number;
+    parseFallbacks?: number;
   };
   /**
    * Scoring model version stamped into the result (ENGINE-001). Allows
@@ -378,6 +381,7 @@ interface ScanResult {
     trustModelVersion?: string;
     scoringModelVersion?: string;
     frameworkSupportMatrixVersion?: string;
+    commit?: string;
   };
   /**
    * Evidence Graph (R4c): the chain-law links (VERDICT ← EVIDENCE ←
@@ -956,9 +960,9 @@ interface ScanContext {
   maxFiles: number;
   /** R4c Scope Integrity: counted matcher exclusions (optional — adapters
    * whose discovery walks sharedWalk pass this through to the counters). */
-  onIgnored?: () => void;
+  onIgnored?: (path: string) => void;
   /** R4c Scope Integrity: counted files no adapter claims (optional). */
-  onUnrecognized?: () => void;
+  onUnrecognized?: (path: string) => void;
   /**
    * Called when a rule throws on a file (audit R-9): crash isolation
    * stays silent by default, but the scan counts it and `--debug`
@@ -1291,7 +1295,9 @@ interface FileAnalysisResult {
   testDeclarationCount: number;
   rulesPartial: boolean;
   parseFailed: number;
+  parseFallbacks: number;
   scanned: number;
+  analyzed: number;
 }
 declare function runFileAnalysisPhase(findings: Finding[], testFiles: string[], workspace: Workspace, activeRules: UniversalRule[], hooks: ScanHooks, cache: ScanCache, rulesDigest: string, deadline: number, truncationReasons: Set<string>, declarationsByFile: Map<string, number>, fileProvenance: Array<{
   path: string;
@@ -1306,6 +1312,7 @@ interface PostScanResult {
   suppressionCount: number;
   frameworks: ReturnType<typeof detectFrameworks>;
   runtimeReportPath: string | undefined;
+  runtimeIncomplete: boolean;
   /** Aggregate forensic classifications from the ingested runtime report. */
   forensicVerdicts: ForensicVerdictSummary | undefined;
   config: ReturnType<typeof loadConfig>["config"];
@@ -1331,7 +1338,9 @@ interface AssembleScanResultInput {
   scopeIgnored: number;
   scopeUnrecognized: number;
   parseFailed: number;
+  parseFallbacks?: number;
   scanned: number;
+  analyzed?: number;
   testFiles: string[];
   workspace: Workspace;
   scanRoot: Workspace;
@@ -1350,6 +1359,7 @@ interface AssembleScanResultInput {
   suppressionCount: number;
   frameworks: ReturnType<typeof detectFrameworks>;
   runtimeReportPath: string | undefined;
+  runtimeIncomplete?: boolean;
   forensicVerdicts: ForensicVerdictSummary | undefined;
   config: ReturnType<typeof loadConfig>["config"];
   fileProvenance: Array<{
@@ -1383,7 +1393,7 @@ declare function runScan$1(args: CliArgs, hooks?: ScanHooks): Promise<ScanResult
  * scripts/sync-sarif-version.cjs and guarded by the version-consistency
  * spec. cli.ts re-exports this as CLI_VERSION.
  */
-declare const ENGINE_VERSION = "2.1.0";
+declare const ENGINE_VERSION = "3.0.0";
 //#endregion
 //#region src/cli-io.d.ts
 /**
@@ -1684,6 +1694,8 @@ export interface UsageErrorDetail {
   /** The flag whose value was rejected (`--tone` for `--tone loud`). */
   flag?: string | undefined;
 }
+export declare const DEFAULT_MAX_DURATION_MS = 600000;
+export declare const MAX_DURATION_MS = 3600000;
 export declare function parseArgs(argv: string[], onError?: (detail: UsageErrorDetail) => void): CliArgs | null;
 /** Hand-rolled Levenshtein distance (plan M2: no new dependencies). */
 export declare function levenshtein(a: string, b: string): number;