mjolnir-qa 3.0.0 → 4.0.0

package/dist/mcp/stdio.mjs

@@ -2,14 +2,14 @@ import { createRequire } from "node:module";
 import { createInterface } from "node:readline";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { createHash, randomBytes } from "node:crypto";
-import { closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { execFileSync } from "node:child_process";
 import * as ts$2 from "ts-morph";
 import ts, { Project, SyntaxKind, ts as ts$1 } from "ts-morph";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { Language, Parser } from "web-tree-sitter";
 import { parse } from "yaml";
-import { execFileSync } from "node:child_process";
 import { inflateRawSync } from "node:zlib";
 //#region src/types.ts
 /** Severity ladder. Order matters for sorting and gating. */
@@ -19,6 +19,32 @@ const SEVERITY_ORDER = [
 	"info"
 ];
 /**
+* Trust levels (Verification Trust Evolution Plan §16): the OVERALL
+* trust a consumer can place in one finding, combining the static
+* evidence ladder (E0–E2) with RUNTIME corroboration from a real run
+* report. Exposed honestly, never overclaimed:
+*   L0 — observation only (E0, no runtime evidence).
+*   L1 — heuristic static evidence (E1), no runtime evidence.
+*   L2 — deterministic static evidence (E2), no runtime evidence.
+*   L3 — RUNTIME: the file containing this finding appeared in a real
+*        run report (tests in that file executed).
+*   L4 — RUNTIME: the specific test containing this finding was
+*        identified in the report and executed (its outcome is known).
+*   L5 — RUNTIME: the run verdict directly corroborates the DEFECT
+*        class (e.g. a flake-risk finding whose test actually flaked,
+*        retried, or timed out in the report).
+* INVARIANT (structurally enforced): L3–L5 require runtime
+* corroboration — a static-only finding can never claim L4/L5.
+*/
+const TRUST_ORDER = [
+	"L0",
+	"L1",
+	"L2",
+	"L3",
+	"L4",
+	"L5"
+];
+/**
 * Honest default evidence level for a finding (Honesty Core Phase 1).
 * Derivation is deterministic and conservative:
 *   observation → E0 (never proof)
@@ -701,21 +727,13 @@ const MEASURED_FP = {
 * empty scan is an observation, not a proof).
 */
 function summaryTrustLevel(findings) {
-	const order = [
-		"L0",
-		"L1",
-		"L2",
-		"L3",
-		"L4",
-		"L5"
-	];
 	let best = 0;
 	for (const f of findings) {
 		const t = f.trustLevel ?? "L2";
-		const idx = order.indexOf(t);
+		const idx = TRUST_ORDER.indexOf(t);
 		if (idx > best) best = idx;
 	}
-	return order[best];
+	return TRUST_ORDER[best];
 }
 /**
 * A finding's trust rung (0–5) on the canonical ladder. Corroborated
@@ -726,14 +744,7 @@ function summaryTrustLevel(findings) {
 */
 function trustRung(f) {
 	const t = f.trustLevel ?? deriveTrustLevel(f);
-	return [
-		"L0",
-		"L1",
-		"L2",
-		"L3",
-		"L4",
-		"L5"
-	].indexOf(t);
+	return TRUST_ORDER.indexOf(t);
 }
 /**
 * Hard incompleteness ceilings (plan §6: partial/crash/truncation;
@@ -870,6 +881,17 @@ function buildRunIdentity(input) {
 		engineVersion: input.engineVersion
 	};
 	if (input.reportDigest) verdictInputs.reportDigest = input.reportDigest;
+	if (input.commit !== void 0) verdictInputs.commit = input.commit;
+	if (input.tree !== void 0) verdictInputs.tree = input.tree;
+	if (input.lockfile !== void 0) verdictInputs.lockfile = input.lockfile;
+	if (input.candidate !== void 0) verdictInputs.candidate = {
+		manifestId: input.candidate.manifestId,
+		state: input.candidate.state,
+		candidateSha: input.candidate.candidateSha,
+		baseSha: input.candidate.baseSha,
+		packageSha256: input.candidate.packageSha256,
+		lockfileSha256: input.candidate.lockfileSha256
+	};
 	if (input.trustModelVersion !== void 0) verdictInputs.trustModelVersion = input.trustModelVersion;
 	if (input.scoringModelVersion !== void 0) verdictInputs.scoringModelVersion = input.scoringModelVersion;
 	if (input.frameworkSupportMatrixVersion !== void 0) verdictInputs.frameworkSupportMatrixVersion = input.frameworkSupportMatrixVersion;
@@ -877,15 +899,31 @@ function buildRunIdentity(input) {
 	if (input.suppressionFingerprint !== void 0) verdictInputs.suppressionFingerprint = input.suppressionFingerprint;
 	if (input.policyFingerprint !== void 0) verdictInputs.policyFingerprint = input.policyFingerprint;
 	if (input.historicalEvidenceFingerprint !== void 0) verdictInputs.historicalEvidenceFingerprint = input.historicalEvidenceFingerprint;
+	const scanId = sha256$1(canonical(verdictInputs));
+	const boundLinks = [
+		"input",
+		"rules",
+		"config",
+		"engine"
+	];
+	if (input.commit !== void 0) boundLinks.push("commit");
+	if (input.tree !== void 0) boundLinks.push("tree");
+	if (input.lockfile !== void 0) boundLinks.push("lockfile");
+	if (input.candidate !== void 0) boundLinks.push("candidate");
 	return {
-		scanId: sha256$1(canonical(verdictInputs)),
+		scanId,
 		inputFingerprint,
 		rulesDigest,
 		configFingerprint,
 		engineVersion: input.engineVersion,
+		boundLinks,
 		...input.trustModelVersion !== void 0 ? { trustModelVersion: input.trustModelVersion } : {},
 		...input.scoringModelVersion !== void 0 ? { scoringModelVersion: input.scoringModelVersion } : {},
-		...input.frameworkSupportMatrixVersion !== void 0 ? { frameworkSupportMatrixVersion: input.frameworkSupportMatrixVersion } : {}
+		...input.frameworkSupportMatrixVersion !== void 0 ? { frameworkSupportMatrixVersion: input.frameworkSupportMatrixVersion } : {},
+		...input.commit !== void 0 ? { commit: input.commit } : {},
+		...input.tree !== void 0 ? { tree: input.tree } : {},
+		...input.lockfile !== void 0 ? { lockfile: input.lockfile } : {},
+		...input.candidate !== void 0 ? { candidate: input.candidate } : {}
 	};
 }
 /**
@@ -926,9 +964,218 @@ function buildEvidenceGraph(parts) {
 				...parts.reproduction !== void 0 ? { ref: parts.reproduction } : {}
 			}
 		],
-		...parts.runId !== void 0 ? { runId: parts.runId } : {}
+		...parts.runId !== void 0 ? { runId: parts.runId } : {},
+		...parts.candidate !== void 0 ? { candidate: {
+			manifestId: parts.candidate.manifestId,
+			candidateSha: parts.candidate.candidateSha
+		} } : {}
+	};
+}
+//#endregion
+//#region src/engine/file-executor.ts
+function cacheHitOutcome(job) {
+	return {
+		path: job.path,
+		status: "CACHE_HIT",
+		findings: [...job.cacheHit ?? []],
+		parseFallback: false
+	};
+}
+/**
+* Drive a list of jobs through an executor and return outcomes in INPUT order.
+*
+* This is the function the pipeline calls. It is executor-agnostic on purpose:
+* swapping in a pooled executor must not require touching the caller, and the
+* ordering guarantee has to live here or it would live in each executor and
+* drift between them.
+*/
+async function executeFiles(jobs, executor, context = {}) {
+	const outcomes = new Array(jobs.length);
+	if (executor.concurrency <= 1 || jobs.length <= 1) {
+		for (let i = 0; i < jobs.length; i++) {
+			const job = jobs[i];
+			context.onProgress?.({
+				done: i,
+				total: jobs.length,
+				path: job.path
+			});
+			outcomes[i] = await runOne(job, executor, context);
+		}
+		context.onProgress?.({
+			done: jobs.length,
+			total: jobs.length,
+			path: jobs[jobs.length - 1]?.path ?? ""
+		});
+		return outcomes;
+	}
+	let next = 0;
+	let completed = 0;
+	const inFlight = /* @__PURE__ */ new Set();
+	const limit = Math.max(1, Math.floor(executor.concurrency));
+	const worker = async () => {
+		for (;;) {
+			const index = next++;
+			if (index >= jobs.length) return;
+			const job = jobs[index];
+			outcomes[index] = await runOne(job, executor, context);
+			completed++;
+			context.onProgress?.({
+				done: completed,
+				total: jobs.length,
+				path: job.path
+			});
+		}
+	};
+	for (let i = 0; i < Math.min(limit, jobs.length); i++) {
+		const promise = worker().then(() => void 0);
+		inFlight.add(promise);
+	}
+	await Promise.all(inFlight);
+	return outcomes;
+}
+async function runOne(job, executor, context) {
+	if (job.cacheHit !== void 0) return cacheHitOutcome(job);
+	try {
+		return await executor.execute(job, context);
+	} catch (error) {
+		return {
+			path: job.path,
+			status: "FAILED",
+			findings: [],
+			parseFallback: false,
+			error: error instanceof Error ? error : new Error(String(error))
+		};
+	}
+}
+/**
+* The strategy the pipeline uses today.
+*
+* `runOne` is supplied by the pipeline because parsing and rule execution
+* need the adapter and the active rule set, which are pipeline concerns. The
+* executor's job is the BOUNDARY and the bookkeeping, not the analysis — so
+* this factory exists to bind those two without the executor importing the
+* pipeline (which would be a cycle).
+*/
+function createExecutor(name, concurrency, runOne) {
+	return {
+		name,
+		concurrency,
+		execute: runOne
+	};
+}
+//#endregion
+//#region src/engine/candidate-binding.ts
+/**
+* Candidate binding (plan V5-010).
+*
+* Reads a candidate trust manifest and produces the immutable
+* `CandidateBinding` that a run identity is bound to. It also computes the
+* repository facts (commit, tree, lockfile digest) that the identity was
+* missing until this module existed.
+*
+* The law here is ABSENCE over invention. A manifest that is missing,
+* unreadable, or internally contradictory yields NO binding — not a partial
+* one. A consumer that can see "not bound" can refuse to trust the run; a
+* consumer handed a half-filled binding cannot tell what is missing, and will
+* trust the parts that are there.
+*/
+const CANDIDATE_MANIFEST_PATH = "candidate-trust-manifest.json";
+const SHA40 = /^[a-f0-9]{40}$/;
+const SHA256 = /^[a-f0-9]{64}$/;
+const STATES = ["WORKING_CANDIDATE", "RELEASE_CANDIDATE"];
+const AUTHORIZATION = ["NOT_AUTHORIZED", "AUTHORIZED"];
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sha256File(path) {
+	try {
+		return createHash("sha256").update(readFileSync(path)).digest("hex");
+	} catch {
+		return;
+	}
+}
+function gitLine(root, args) {
+	try {
+		const trimmed = execFileSync("git", args, {
+			cwd: root,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			windowsHide: true
+		}).trim();
+		return trimmed.length > 0 ? trimmed : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* The commit and tree the working tree is at. Both absent outside a
+* repository or with no commits — never substituted with a placeholder.
+*/
+function bindRepository(root) {
+	const commit = gitLine(root, ["rev-parse", "HEAD"]);
+	const tree = gitLine(root, ["rev-parse", "HEAD^{tree}"]);
+	const lockfile = sha256File(join(root, "package-lock.json"));
+	return {
+		...commit !== void 0 ? { commit } : {},
+		...tree !== void 0 ? { tree } : {},
+		...lockfile !== void 0 ? { lockfile } : {}
+	};
+}
+/**
+* Parse a candidate manifest into a binding, or return null when it cannot
+* honestly be bound.
+*
+* Null is returned for: no manifest, unreadable JSON, a missing or malformed
+* required field, or a state/authorization combination that cannot legally
+* exist (a WORKING_CANDIDATE carrying a commit, for example — the same
+* contradiction the release decision evaluator treats as BLOCKED).
+*/
+function parseCandidateBinding(raw) {
+	if (!isRecord$1(raw)) return null;
+	const identity = raw.identity;
+	if (!isRecord$1(identity)) return null;
+	const state = identity.state;
+	const candidateSha = identity.candidateSha;
+	const baseSha = identity.baseSha;
+	const packageSha256 = identity.packageSha256;
+	const lockfileSha256 = identity.lockfileSha256;
+	if (typeof state !== "string" || !STATES.includes(state)) return null;
+	if (typeof baseSha !== "string" || !SHA40.test(baseSha)) return null;
+	if (typeof packageSha256 !== "string" || !SHA256.test(packageSha256)) return null;
+	if (typeof lockfileSha256 !== "string" || !SHA256.test(lockfileSha256)) return null;
+	if (candidateSha !== null && (typeof candidateSha !== "string" || !SHA40.test(candidateSha))) return null;
+	const manifestId = raw.manifestId;
+	if (typeof manifestId !== "string" || manifestId.length === 0) return null;
+	const owner = typeof raw.owner === "string" ? raw.owner : "UNASSIGNED";
+	const authorization = raw.releaseAuthorizationState;
+	if (typeof authorization !== "string" || !AUTHORIZATION.includes(authorization)) return null;
+	if (state === "WORKING_CANDIDATE") {
+		if (candidateSha !== null) return null;
+		if (authorization !== "NOT_AUTHORIZED") return null;
+	} else if (candidateSha === null) return null;
+	return {
+		manifestId,
+		state,
+		candidateSha,
+		baseSha,
+		packageSha256,
+		lockfileSha256,
+		owner,
+		releaseAuthorizationState: authorization
 	};
 }
+/** Read and bind the manifest from a checkout, or null. */
+function readCandidateBinding(root, manifestPath = CANDIDATE_MANIFEST_PATH) {
+	try {
+		return parseCandidateBinding(JSON.parse(readFileSync(join(root, manifestPath), "utf8")));
+	} catch {
+		return null;
+	}
+}
 //#endregion
 //#region src/engine/version.ts
 /**
@@ -939,7 +1186,7 @@ function buildEvidenceGraph(parts) {
 * scripts/sync-sarif-version.cjs and guarded by the version-consistency
 * spec. cli.ts re-exports this as CLI_VERSION.
 */
-const ENGINE_VERSION = "3.0.0";
+const ENGINE_VERSION = "4.0.0";
 //#endregion
 //#region src/engine/contract-versions.ts
 /**
@@ -1347,20 +1594,9 @@ function validate(cfg, knownRuleIds) {
 	return warnings;
 }
 /**
-* Bug-audit QA-2026-08-30 QA-6: the 90-day policy in the README was only
-* applied at WRITE time by the `ignore` command — a hand-written entry
-* without `expires` stayed active forever, silently bypassing the
-* documented window.
-*
-* Audit S4 (remediation plan): the config-file MTIME is no longer an
-* expiry anchor. Anchoring the 90-day default at mtime meant ANY edit to
-* mjolnir.config.json — a reformat, an unrelated key, a `touch` — reset
-* the 90-day window for EVERY hand-authored entry: suppressions could be
-* extended indefinitely without touching their own fields. The expiry is
-* now the entry's explicit `expires` date alone; an entry without one
-* stays active and is honestly labeled "(no expiry set)" in the
-* suppressions report. Hand-authored entries should declare `expires` at
-* creation (README §Configuration documents the shape).
+* Expiry is evaluated only from an explicit ISO `expires` date. A missing
+* date remains active and is reported as having no expiry. Config-file mtime
+* is never an expiry anchor.
 */
 function isSuppressionActive(ign, now = /* @__PURE__ */ new Date()) {
 	if (!ign.expires) return true;
@@ -1638,7 +1874,33 @@ function sharedWalk(options) {
 *
 * When nothing is detectable we report `unknown` and the scanner analyzes
 * all test-looking files — stated honestly in output rather than guessed.
+*
+* ## One ID space (plan V5-024)
+*
+* This detector used to declare its own `TestFramework` union of three
+* literals while `src/frameworks/framework-inventory.ts` catalogued fourteen
+* framework ids. Two vocabularies for one concept is how a support matrix
+* starts disagreeing with what the tool actually detects: a framework can be
+* catalogued as OFFICIAL_PARTIAL and never once be emitted by the code that
+* claims to detect it.
+*
+* So the ids here are `FrameworkId`s — the inventory's own vocabulary — and
+* `DETECTABLE_TEST_FRAMEWORKS` is the subset this detector can actually
+* resolve from a checkout. That subset is the HONEST limit of detection, and
+* `detectableVsCatalogued()` reports the remainder rather than letting a
+* three-item list read as the whole catalog.
 */
+/**
+* The catalogued frameworks whose detection is implemented today.
+*
+* Every entry must exist in the inventory — enforced by the parity spec, not
+* by comment.
+*/
+const DETECTABLE_TEST_FRAMEWORKS = [
+	"jest",
+	"vitest",
+	"playwright"
+];
 const CONFIG_FILES = {
 	jest: [
 		"jest.config.ts",
@@ -1657,7 +1919,7 @@ const CONFIG_FILES = {
 };
 function detectFrameworks(ws) {
 	const found = /* @__PURE__ */ new Set();
-	for (const fw of Object.keys(CONFIG_FILES)) if (CONFIG_FILES[fw].some((f) => existsSync(join(ws.root, f)))) found.add(fw);
+	for (const fw of DETECTABLE_TEST_FRAMEWORKS) if (CONFIG_FILES[fw].some((f) => existsSync(join(ws.root, f)))) found.add(fw);
 	if (!found.has("jest") && ws.packageJson["jest"] !== void 0) found.add("jest");
 	const deps = {
 		...ws.packageJson["dependencies"],
@@ -1679,11 +1941,7 @@ function detectFrameworks(ws) {
 		};
 	}
 	return {
-		frameworks: [
-			"jest",
-			"vitest",
-			"playwright"
-		].filter((f) => found.has(f)),
+		frameworks: DETECTABLE_TEST_FRAMEWORKS.filter((f) => found.has(f)),
 		unknown: false
 	};
 }
@@ -1700,6 +1958,13 @@ function detectFrameworks(ws) {
 * byte-identical — a score shift is a regression, not an improvement.
 */
 let project = null;
+/**
+* The shared ts-morph project.
+*
+* Exported so an adapter's `dispose()` can evict the file it parsed: ts-morph
+* caches by file path, so without eviction a long scan holds every parsed
+* SourceFile until the process exits (plan V5-021).
+*/
 function getProject() {
 	if (!project) project = new Project({
 		useInMemoryFileSystem: true,
@@ -2226,7 +2491,36 @@ function frameworkFilterApplies(rule, file) {
 * "cypress", `@jest/globals` → "jest", `vitest` → "vitest". Config
 * gating is rule-declared (`configFiles`), not hard-coded here.
 */
-const TEST_FILE_RE = /\.(?:test|spec)\.(?:js|jsx|ts|tsx|mjs|cjs)$|\.cy\.(?:js|jsx|ts|tsx)$/;
+/**
+* `.test.` / `.spec.` filenames, plus the Cypress `.cy.` convention.
+*
+* `mts` and `cts` are TypeScript's Node-native ESM/CJS extensions. They were
+* missing here, and the omission was invisible in the worst way — not a wrong
+* answer, but an ABSENCE.
+*
+* Reproduced: a repo containing two byte-identical tests, one at
+* `tests/control.spec.ts` and one at `tests/slow.spec.mts`, each with a
+* `QA-TEST-004` hard sleep:
+*
+*   discovered: 1, analyzed: 1, unrecognized: 1, scopeVerdict: "PARTIAL"
+*
+* The `.ts` test produced the finding. The `.mts` test produced nothing at
+* all — it was never scanned, so every rule that could have caught it was
+* silent on it, with no finding, no low-evidence note, and no indication that
+* a test file had been skipped. A test scanner that cannot see a whole file
+* extension has a false green that is invisible by construction: the reader
+* has nothing to distrust, because there is nothing there.
+*
+* The corroboration that this was an oversight rather than a decision sits
+* four lines below: PW_CONFIG_RE already accepted `cts`. The config regex knew
+* about the Node-native extensions; the test-file regex did not.
+*
+* `discovery/scan-adapters.ts:isUnrecognizedSourceCandidate` already counted
+* these paths as uncovered surface, so the scope accounting had been reporting
+* the hole the whole time — it was being read as a known limitation rather than
+* as a defect.
+*/
+const TEST_FILE_RE = /\.(?:test|spec)\.(?:js|jsx|ts|tsx|mjs|cjs|mts|cts)$|\.cy\.(?:js|jsx|ts|tsx)$/;
 /**
 * Fallback config list for `configOnly` rules that do not declare
 * `configFiles` (the legacy playwright.config.* gating, preserved
@@ -2333,11 +2627,42 @@ const typescriptAdapter = {
 			fixtureDirMemo: /* @__PURE__ */ new Map()
 		});
 	},
+	/**
+	* The ONE AST seam (plan V5-021).
+	*
+	* This adapter used to parse inside `runRules`, on the synchronous path,
+	* while Java and C# exposed the async `parseAst` hook. Two seams meant two
+	* sets of consequences, both of them bad:
+	*
+	*   - the pipeline computes `wantsAst` as `adapter.parseAst !== undefined`,
+	*     so a TypeScript file never took the AST path through the pipeline at
+	*     all, and its parse failures were invisible to the pipeline's
+	*     fallback counters;
+	*   - nothing called `dispose()` for the ts-morph path, so a scan held
+	*     every parsed SourceFile for its whole lifetime.
+	*
+	* Parsing now happens here, once, through the same contract every other
+	* adapter uses. `dispose()` drops this file's SourceFile from the shared
+	* project; ts-morph caches per file path, so removing it is what keeps
+	* memory proportional to one file rather than to the whole scan.
+	*/
+	parseAst(file) {
+		const sourceFile = parseTsFile(file);
+		if (sourceFile === void 0) return void 0;
+		return {
+			ast: sourceFile,
+			dispose: () => {
+				try {
+					getProject().removeSourceFile(sourceFile);
+				} catch {}
+			}
+		};
+	},
 	runRules(rules, file, emit, onCrash, budget) {
-		const withAst = {
+		const withAst = file.ast === void 0 ? {
 			...file,
 			ast: parseTsFile(file)
-		};
+		} : file;
 		const withTags = {
 			...withAst,
 			frameworkTags: frameworkTagsFromImports(withAst.text)
@@ -3756,9 +4081,37 @@ function discoverAllTestFiles(ctx, languageAdapters, buckets, fixtureDirMemo) {
 		}
 	});
 }
+/**
+* Would ignoring this file have removed it from the scanned surface?
+*
+* The bug this fixes, reproduced: a repo containing a real test file plus
+* `vendor.min.js` and `pnpm-lock.yaml` reported
+*
+*   discovered: 1, analyzed: 1, ignored: 2, scopeVerdict: "PARTIAL"
+*
+* Every discovered test file HAD been analyzed. The surface was complete. But
+* DEFAULT_IGNORES matches minified bundles and lockfiles, and the ignored
+* counter accepted any path with a source extension — so a minified bundle and
+* a lockfile downgraded a finished scan to "unverified".
+*
+* That is not a conservative bias, it is a broken signal. The terminal tells
+* the reader "some files were not analyzed, so the surface is unverified" —
+* which was false. And because minified bundles and lockfiles exist in
+* essentially every real repository, a PROVEN scan was unreachable in
+* practice, so the corpus regression guard failed 23 of 37 repositories on
+* exactly this. A gate that cannot pass teaches people to ignore it.
+*
+* The asymmetry is the tell. `isUnrecognizedSourceCandidate` below applies a
+* test-relevance test before counting a file; this one did not. Both count
+* against the same verdict, so both must ask the same question.
+*
+* An ignored file that IS a test file still downgrades the verdict. That is
+* the case the honesty law exists for, and this does not touch it.
+*/
 function isScopeRelevantIgnored(path) {
 	const name = path.replaceAll("\\", "/").split("/").pop() ?? path;
-	return /\.(?:[cm]?[jt]sx?|py|java|cs|ya?ml|min\.js)$/i.test(name);
+	if (!/\.(?:[cm]?[jt]sx?|py|java|cs|ya?ml|min\.js)$/i.test(name)) return false;
+	return isKnownTestFile(path);
 }
 function isUnrecognizedSourceCandidate(path) {
 	const normalized = path.replaceAll("\\", "/");
@@ -7608,7 +7961,6 @@ const pyBareTruthinessAssert = defineRule({
 		const re = /^[ \t]*assert\s+([A-Za-z_][\w.]*(?:\([^()]*\))?)[ \t]*$/gm;
 		const predicateRe = /^(?:(?:any|all|isinstance)\s*\(|[\w.]*\.(?:startswith|endswith|exists|isdir|isfile|islink|ismount|check|isdigit|isalpha|isalnum|isnumeric|isdecimal|isspace|islower|isupper|istitle|isidentifier|isprintable|isascii)\s*\(|re\.(?:match|search|fullmatch)\s*\()/;
 		const isGuardFollowedByRealUse = (text, matchIndex, target) => {
-			const root = target.split(".")[0];
 			const lineEnd = text.indexOf("\n", matchIndex);
 			if (lineEnd === -1) return false;
 			const lines = text.slice(lineEnd + 1).split("\n");
@@ -7618,8 +7970,11 @@ const pyBareTruthinessAssert = defineRule({
 				if (/^\s*def\s/.test(l) && window.length > 0) break;
 				window.push(l);
 			}
-			const usesRoot = new RegExp(`\\b${root}\\b`);
-			return window.some((l) => usesRoot.test(l));
+			const root = target.match(/^[a-z_]\w*/i)?.[0];
+			if (!root) return false;
+			return window.some((line) => {
+				return (line.match(/[a-z_]\w*/gi) ?? []).some((token) => token === root);
+			});
 		};
 		let m;
 		while ((m = re.exec(text)) !== null) {
@@ -11581,6 +11936,22 @@ function normalizeOne(report, artifact, v) {
 function buildEvidenceRecords(report, artifact) {
 	return report.verdicts.map((v) => normalizeOne(report, artifact, v)).sort(compareEvidenceRecords);
 }
+function countEvidence(records) {
+	const counts = {
+		total: records.length,
+		failed: 0,
+		flaky: 0,
+		skipped: 0,
+		timedOut: 0
+	};
+	for (const r of records) {
+		if (r.status.failed) counts.failed++;
+		if (r.status.passedOnRetry) counts.flaky++;
+		if (r.status.skipped) counts.skipped++;
+		if (r.status.timedOut) counts.timedOut++;
+	}
+	return counts;
+}
 //#endregion
 //#region src/engine/provenance.ts
 const GENERATED_HEADER_RE = /^\s*(?:\/\/|#|\/\*)\s*(?:auto[- ]?generated|generated by|do not edit)/i;
@@ -11868,6 +12239,11 @@ var DependencyGraph = class {
 	get size() {
 		return this.nodes.size;
 	}
+	/** Whether the graph knows this exact key. Reachability must not
+	*  treat "not in the graph" as "nothing to traverse" without saying so. */
+	has(path) {
+		return this.nodes.has(path);
+	}
 };
 function parsePackageJson(filePath) {
 	if (!existsSync(filePath)) return void 0;
@@ -11992,120 +12368,394 @@ function isIncrementalSafe(changedFiles) {
 	};
 }
 //#endregion
-//#region src/engine/monorepo-analysis.ts
-const WORTHY_THRESHOLD = 80;
-const NEEDS_WORK_THRESHOLD = 50;
-function verdictOf(score) {
-	if (score === null) return "fail";
-	if (score >= WORTHY_THRESHOLD) return "pass";
-	if (score >= NEEDS_WORK_THRESHOLD) return "warn";
-	return "fail";
-}
-function hasBlocker(findings) {
-	return findings.some((f) => f.severity === "error");
-}
+//#region src/brand/tokens.ts
 /**
-* Aggregate per-package results into an overall verdict.
+* The single source of brand truth.
 *
-* Worst-package propagation: if ANY package has a blocker (error-severity
-* finding) or a failing score, the overall result fails regardless of
-* strategy. This is the safety net — a single poisoned package must not
-* hide behind averaging.
+* Every colour, typeface and motion constant Mjölnir shows a human —
+* terminal, README SVGs, demo video, website, docs, badges — resolves to
+* a value in this file. Nothing else may define one.
+*
+* WHY THIS EXISTS. Before it, the palette existed in six independent
+* copies: `site/.vitepress/theme/styles/vars.css`, `NORSE` in
+* `src/reporter/theme.ts`, `scripts/readme-svg.ts`,
+* `scripts/video/terminal-page.ts`, `scripts/generate-readme-architecture.ts`
+* and the table in `assets/brand/README.md`. Exactly one pair of those
+* was guarded (site-doctor Check 8, doc ↔ vars.css). The unguarded edges
+* are where the shipped surfaces drifted apart: the terminal and the site
+* disagreed on six semantic roles, the architecture diagram invented its
+* own neutral ramp, and the README badges still carried a palette retired
+* two releases earlier. `scripts/brand-doctor.mjs` now checks every edge
+* against this file.
+*
+* PURITY. Pure data. No I/O, no rendering, no environment access, no
+* imports, no logic. Consumers convert (hex → ANSI triplet, hex → CSS)
+* themselves. Same reason `presentation.ts` is pure: it makes the whole
+* thing golden-testable and safe to ship inside the npm package, where
+* it costs a few hundred bytes and replaces values the package already
+* carried anyway.
+*
+* DERIVATION. The palette is the one derived from the logo in PR #20
+* (brushed steel and forge gold under an aurora, over midnight iron).
+* Where the terminal disagreed with it, the terminal converges — see
+* `PENDING_TERMINAL` below. Full rationale: `assets/brand/README.md`.
+*
+* ACCESSIBILITY. Every foreground token in `BRAND` meets WCAG AA
+* (≥ 4.5:1) against every surface token it is allowed to sit on. That is
+* not a claim, it is `brand-doctor` rule 8, which computes the ratios.
+* The weakest legal pairing is `steelDim` on `ink800` at 5.00:1.
 */
-function analyzeMonorepo(packages, config) {
-	const results = packages.map((p) => ({
-		...p,
-		verdict: hasBlocker(p.findings) ? "fail" : verdictOf(p.score)
-	}));
-	if (results.length === 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	const blockerPkg = results.find((r) => r.verdict === "fail" || hasBlocker(r.findings));
-	if (blockerPkg) return {
-		packages: results,
-		overallScore: blockerPkg.score,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy,
-		blockerPackage: blockerPkg.packageName
-	};
-	switch (config.weightingStrategy) {
-		case "worst-package": return worstPackageAggregation(results, config);
-		case "average": return averageAggregation(results, config);
-		case "configurable": return configurableAggregation(results, config);
-	}
-}
-function worstPackageAggregation(results, config) {
-	const firstResult = results[0];
-	if (firstResult === void 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	let worst = firstResult;
-	for (const r of results) if ((r.score ?? 0) < (worst.score ?? 0)) worst = r;
-	return {
-		packages: results,
-		overallScore: worst.score,
-		overallVerdict: worst.verdict,
-		strategy: config.weightingStrategy,
-		...worst.verdict === "fail" ? { blockerPackage: worst.packageName } : {}
-	};
-}
-function averageAggregation(results, config) {
-	const scored = results.filter((r) => r.score !== null);
-	if (scored.length === 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	const avg = scored.reduce((sum, r) => sum + (r.score ?? 0), 0) / scored.length;
-	return {
-		packages: results,
-		overallScore: Math.round(avg),
-		overallVerdict: verdictOf(Math.round(avg)),
-		strategy: config.weightingStrategy
-	};
-}
-function configurableAggregation(results, config) {
-	const weights = config.packageWeights ?? {};
-	let totalWeight = 0;
-	let weightedSum = 0;
-	for (const r of results) {
-		const w = weights[r.packageName] ?? 1;
-		totalWeight += w;
-		weightedSum += (r.score ?? 0) * w;
-	}
-	if (totalWeight === 0) return {
-		packages: results,
-		overallScore: null,
-		overallVerdict: "fail",
-		strategy: config.weightingStrategy
-	};
-	const score = Math.round(weightedSum / totalWeight);
-	return {
-		packages: results,
-		overallScore: score,
-		overallVerdict: verdictOf(score),
-		strategy: config.weightingStrategy
-	};
-}
-//#endregion
-//#region src/lib/fs-atomic.ts
 /**
-* Atomic file writes (audit S9).
-*
-* Every durability-critical write in Mjölnir (baseline, stats, badge,
-* TRIAGE.md, scaffolded rule files) used to hand-roll
-* `writeFileSync(path, data)` — a crash mid-write left a TRUNCATED file
-* at the real path, and a subsequent read (diff, badge endpoint) served
-* confident nonsense from it.
+* The two brand hues plus the neutral they sit on.
 *
-* `writeFileAtomic` writes to a temp sibling, then RENAMES. On the same
+* GOLD IS SCARCE. It means forged / certified / earned / decisive — the
+* primary mark, the FORGED state, one call to action. It is not a paint
+* bucket: gold as default text, default border or default heading is a
+* brand-doctor finding, not a style choice.
+*
+* AURORA is verification energy — the secondary, and the hue that marks
+* the runtime half of the trust ladder.
+*/
+const BRAND = {
+	gold: "#C19A34",
+	goldBright: "#E6BD57",
+	goldHot: "#F4DC9C",
+	/** Pressed / deepest gold — the only step dark enough to carry white. */
+	goldDeep: "#A5811C",
+	aurora: "#37ABBD",
+	auroraBright: "#45C1D4",
+	auroraCyan: "#5CBDE0",
+	/** The aurora's outer curtains: atmosphere and section identity only,
+	* never a verdict or a status. */
+	auroraGreen: "#5FD6A4",
+	auroraViolet: "#9D8CF5",
+	steel: "#C8CBCF",
+	steelDim: "#8B939D"
+};
+/**
+* Midnight iron. One ramp, four steps, darkest first.
+*
+* `terminal` and `terminalBar` share one tone deliberately: the window's
+* only seam is a hairline ring and an inset shadow, never a second fill.
+* `chromeDot` is the three window dots — see the note on
+* `PENDING_TERMINAL.chromeDots` for why they are no longer red/amber/green.
+*/
+const SURFACE = {
+	ink950: "#0A1119",
+	ink900: "#0C1420",
+	ink850: "#111A29",
+	ink800: "#18243A",
+	/** Raised panel (cards, elevated surfaces). */
+	panel: "#141F33",
+	/** Soft fill (inline code, quiet chips). */
+	soft: "#1A2740",
+	/** Terminal body — the deepest tone, so a terminal reads as recessed. */
+	terminal: "#0A1119",
+	/** Terminal title bar — the same tone; the seam is shadow, not colour. */
+	terminalBar: "#0A1119",
+	/** The three window dots. One neutral, not a traffic light. */
+	chromeDot: "#18243A"
+};
+const TEXT = {
+	primary: "#EAEEF5",
+	secondary: "#ABB6C6",
+	muted: "#8B939D",
+	/** Ink for text set ON gold (buttons, the FORGED chip). 7.17:1 on `gold`. */
+	onGold: "#0A1119"
+};
+/**
+* Non-score status. `ok` is the one green in the system and it is NOT a
+* score colour — it survives only for contexts with no worthiness
+* meaning ("autofix applied", "analysis complete"). A green score would
+* say "your software is fine", which is the exact claim this product
+* refuses to make.
+*/
+const STATUS = {
+	ok: "#4FB477",
+	info: "#5CC4E0",
+	warning: "#E6BD57",
+	error: "#EC6B66"
+};
+/**
+* The four ScoreState bands plus the unmeasured state. Band thresholds
+* and runes live in `src/reporter/presentation.ts`, which stays free of
+* colour — it emits a palette KEY and each surface resolves it here.
+*
+* `unmeasured` is steel-dim on purpose. UNKNOWN is a legitimate answer,
+* not a failure: colouring it red would make "we did not measure this"
+* look like "this is broken", which is precisely the dishonesty the
+* north-star law exists to prevent.
+*/
+const SCORE = {
+	critical: "#EC6B66",
+	warning: "#E6BD57",
+	trusted: "#5CC4E0",
+	forged: "#F4DC9C",
+	unmeasured: "#8B939D"
+};
+/**
+* E0 → E1 → E2 is a certainty ramp, and it is deliberately HUE-FREE.
+*
+* Evidence level says how sure we are, not whether the news is good. A
+* deterministic proof (E2) is a defect we are certain about — painting
+* it gold or green would read as an achievement. So certainty is carried
+* by brightness alone, and the *shape* does the real work:
+*
+*     E0  open ring        observation, no weight
+*     E1  half-filled      pattern evidence, half weight
+*     E2  sealed           deterministic proof, full weight
+*
+* Colour never carries this alone (R11): the geometry is the signal and
+* survives `--ascii`, `NO_COLOR` and monochrome print.
+*/
+const EVIDENCE = {
+	e0: "#8B939D",
+	e1: "#ABB6C6",
+	e2: "#EAEEF5"
+};
+/**
+* L0–L5, and the most important boundary in the product.
+*
+* L0–L2 are STATIC: the neutral steel ramp, brightening to the static
+* ceiling at L2. L3–L5 require a real run, and the hue changes to aurora
+* exactly there. The boundary is a hue break, not a gradient step,
+* because it is a change of kind and not of degree — a static-only
+* finding can never climb past L2, however confident it is.
+*
+* Every surface that draws the ladder must draw that break.
+*/
+const TRUST = {
+	l0: "#8B939D",
+	l1: "#ABB6C6",
+	l2: "#C8CBCF",
+	l3: "#37ABBD",
+	l4: "#45C1D4",
+	l5: "#5CC4E0"
+};
+SURFACE.ink950, SURFACE.ink900, SURFACE.ink850, SURFACE.ink800, BRAND.steel, BRAND.steelDim, BRAND.gold, BRAND.goldBright, BRAND.goldHot, BRAND.aurora, BRAND.auroraBright, BRAND.auroraCyan, BRAND.auroraGreen, BRAND.auroraViolet;
+SCORE.trusted, SCORE.forged, SCORE.warning, SCORE.critical, STATUS.info, TEXT.onGold, STATUS.ok, EVIDENCE.e0, EVIDENCE.e1, EVIDENCE.e2, TRUST.l0, TRUST.l1, TRUST.l2, TRUST.l3, TRUST.l4, TRUST.l5;
+EVIDENCE.e0, EVIDENCE.e1, EVIDENCE.e2;
+const RUNG_MEANINGS = [
+	"observation only",
+	"heuristic static",
+	"deterministic static",
+	"the finding's file executed",
+	"the finding's test executed",
+	"the run verdict corroborates"
+];
+const RUNG_COLORS = [
+	TRUST.l0,
+	TRUST.l1,
+	TRUST.l2,
+	TRUST.l3,
+	TRUST.l4,
+	TRUST.l5
+];
+RUNG_MEANINGS.map((meaning, i) => ({
+	level: `L${i}`,
+	meaning,
+	runtime: i >= 3,
+	color: RUNG_COLORS[i]
+}));
+const HEADLINES = {
+	critical: "The hammer is cracked — {n} findings break its edge.",
+	warning: "The hammer holds — but {n} findings weigh it down.",
+	trusted: "Held in worthy hands — {n} findings remain.",
+	forged: "Static score 100 — no findings on the analyzed surface.",
+	unmeasured: "No tests found — the hammer cannot be weighed."
+};
+const RUNES = {
+	critical: "ᚲ",
+	warning: "ᚦ",
+	trusted: "ᛏ",
+	forged: "ᛟ",
+	unmeasured: "ᛁ"
+};
+/**
+* The named form of the band boundaries. `report:honesty` /
+* `thresholds:parity` assert that no surface outside this module
+* re-invents a boundary; a consumer that genuinely needs one names it
+* here rather than typing the number.
+*/
+const SCORE_THRESHOLDS = {
+	/** Below this is `critical`. */
+	criticalBelow: 50,
+	/** At or above this is `trusted`. */
+	trustedAtOrAbove: 80,
+	/** The one score that is `forged`. */
+	forgedAt: 100
+};
+/**
+* Band mapping — the one mapping, every consumer: <50 critical,
+* 50–79 warning, 80–99 trusted, 100 forged, null unmeasured.
+*/
+function deriveScoreState(score) {
+	if (score === null) return {
+		score: null,
+		band: "unmeasured",
+		verdict: "UNWORTHY",
+		color: "dim",
+		powerLevel: 0,
+		headline: HEADLINES.unmeasured,
+		rune: RUNES.unmeasured
+	};
+	if (score >= SCORE_THRESHOLDS.forgedAt) return {
+		score,
+		band: "forged",
+		verdict: "FORGED",
+		color: "forged",
+		powerLevel: score,
+		headline: HEADLINES.forged,
+		rune: RUNES.forged
+	};
+	if (score >= 80) return {
+		score,
+		band: "trusted",
+		verdict: "WORTHY",
+		color: "trusted",
+		powerLevel: score,
+		headline: HEADLINES.trusted,
+		rune: RUNES.trusted
+	};
+	if (score >= 50) return {
+		score,
+		band: "warning",
+		verdict: "NEEDS WORK",
+		color: "warning",
+		powerLevel: score,
+		headline: HEADLINES.warning,
+		rune: RUNES.warning
+	};
+	return {
+		score,
+		band: "critical",
+		verdict: "UNWORTHY",
+		color: "error",
+		powerLevel: score,
+		headline: HEADLINES.critical,
+		rune: RUNES.critical
+	};
+}
+//#endregion
+//#region src/engine/monorepo-analysis.ts
+/**
+* Package verdict, derived from the one ScoreState band model (BW-104).
+* These two constants used to be a private copy of the band boundaries;
+* the numeric vocabulary here is a different projection of the same bands
+* — "pass" is trusted or forged, "warn" is warning, "fail" is critical or
+* unmeasurable — so the boundaries are read, never retyped.
+*/
+function verdictOf(score) {
+	if (score === null) return "fail";
+	const band = deriveScoreState(score).band;
+	if (band === "forged" || band === "trusted") return "pass";
+	return band === "warning" ? "warn" : "fail";
+}
+function hasBlocker(findings) {
+	return findings.some((f) => f.severity === "error");
+}
+/**
+* Aggregate per-package results into an overall verdict.
+*
+* Worst-package propagation: if ANY package has a blocker (error-severity
+* finding) or a failing score, the overall result fails regardless of
+* strategy. This is the safety net — a single poisoned package must not
+* hide behind averaging.
+*/
+function analyzeMonorepo(packages, config) {
+	const results = packages.map((p) => ({
+		...p,
+		verdict: hasBlocker(p.findings) ? "fail" : verdictOf(p.score)
+	}));
+	if (results.length === 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	const blockerPkg = results.find((r) => r.verdict === "fail" || hasBlocker(r.findings));
+	if (blockerPkg) return {
+		packages: results,
+		overallScore: blockerPkg.score,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy,
+		blockerPackage: blockerPkg.packageName
+	};
+	switch (config.weightingStrategy) {
+		case "worst-package": return worstPackageAggregation(results, config);
+		case "average": return averageAggregation(results, config);
+		case "configurable": return configurableAggregation(results, config);
+	}
+}
+function worstPackageAggregation(results, config) {
+	const firstResult = results[0];
+	if (firstResult === void 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	let worst = firstResult;
+	for (const r of results) if ((r.score ?? 0) < (worst.score ?? 0)) worst = r;
+	return {
+		packages: results,
+		overallScore: worst.score,
+		overallVerdict: worst.verdict,
+		strategy: config.weightingStrategy,
+		...worst.verdict === "fail" ? { blockerPackage: worst.packageName } : {}
+	};
+}
+function averageAggregation(results, config) {
+	const scored = results.filter((r) => r.score !== null);
+	if (scored.length === 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	const avg = scored.reduce((sum, r) => sum + (r.score ?? 0), 0) / scored.length;
+	return {
+		packages: results,
+		overallScore: Math.round(avg),
+		overallVerdict: verdictOf(Math.round(avg)),
+		strategy: config.weightingStrategy
+	};
+}
+function configurableAggregation(results, config) {
+	const weights = config.packageWeights ?? {};
+	let totalWeight = 0;
+	let weightedSum = 0;
+	for (const r of results) {
+		const w = weights[r.packageName] ?? 1;
+		totalWeight += w;
+		weightedSum += (r.score ?? 0) * w;
+	}
+	if (totalWeight === 0) return {
+		packages: results,
+		overallScore: null,
+		overallVerdict: "fail",
+		strategy: config.weightingStrategy
+	};
+	const score = Math.round(weightedSum / totalWeight);
+	return {
+		packages: results,
+		overallScore: score,
+		overallVerdict: verdictOf(score),
+		strategy: config.weightingStrategy
+	};
+}
+//#endregion
+//#region src/lib/fs-atomic.ts
+/**
+* Atomic file writes (audit S9).
+*
+* Every durability-critical write in Mjölnir (baseline, stats, badge,
+* TRIAGE.md, scaffolded rule files) used to hand-roll
+* `writeFileSync(path, data)` — a crash mid-write left a TRUNCATED file
+* at the real path, and a subsequent read (diff, badge endpoint) served
+* confident nonsense from it.
+*
+* `writeFileAtomic` writes to a temp sibling, then RENAMES. On the same
 * volume rename is atomic: readers see either the complete old file or
 * the complete new file, never a half-written one. The temp name is
 * created with `wx` (exclusive) so concurrent writers cannot interleave,
@@ -12118,6 +12768,10 @@ function atomicTempPath(path) {
 }
 /**
 * Atomically replace `path` with `data`.
+*
+* Accepts binary payloads as well as text: base-tree materialization in
+* `impact` writes git blobs, and a writer that only takes strings forces those
+* call sites back to the non-atomic path rather than keeping them contained.
 */
 function writeFileAtomic(path, data, opts = {}) {
 	const dir = dirname(path);
@@ -12126,7 +12780,8 @@ function writeFileAtomic(path, data, opts = {}) {
 	let fd;
 	try {
 		fd = openSync(tmp, "wx", opts.mode ?? 420);
-		writeSync(fd, data, null, opts.encoding ?? "utf8");
+		if (typeof data === "string") writeSync(fd, data, null, opts.encoding ?? "utf8");
+		else writeSync(fd, data);
 	} finally {
 		if (fd !== void 0) closeSync(fd);
 	}
@@ -12384,173 +13039,6 @@ function createScanCache(root) {
 	};
 }
 //#endregion
-//#region src/brand/tokens.ts
-/**
-* The single source of brand truth.
-*
-* Every colour, typeface and motion constant Mjölnir shows a human —
-* terminal, README SVGs, demo video, website, docs, badges — resolves to
-* a value in this file. Nothing else may define one.
-*
-* WHY THIS EXISTS. Before it, the palette existed in six independent
-* copies: `site/.vitepress/theme/styles/vars.css`, `NORSE` in
-* `src/reporter/theme.ts`, `scripts/readme-svg.ts`,
-* `scripts/video/terminal-page.ts`, `scripts/generate-readme-architecture.ts`
-* and the table in `assets/brand/README.md`. Exactly one pair of those
-* was guarded (site-doctor Check 8, doc ↔ vars.css). The unguarded edges
-* are where the shipped surfaces drifted apart: the terminal and the site
-* disagreed on six semantic roles, the architecture diagram invented its
-* own neutral ramp, and the README badges still carried a palette retired
-* two releases earlier. `scripts/brand-doctor.mjs` now checks every edge
-* against this file.
-*
-* PURITY. Pure data. No I/O, no rendering, no environment access, no
-* imports, no logic. Consumers convert (hex → ANSI triplet, hex → CSS)
-* themselves. Same reason `score-state.ts` is pure: it makes the whole
-* thing golden-testable and safe to ship inside the npm package, where
-* it costs a few hundred bytes and replaces values the package already
-* carried anyway.
-*
-* DERIVATION. The palette is the one derived from the logo in PR #20
-* (brushed steel and forge gold under an aurora, over midnight iron).
-* Where the terminal disagreed with it, the terminal converges — see
-* `PENDING_TERMINAL` below. Full rationale: `assets/brand/README.md`.
-*
-* ACCESSIBILITY. Every foreground token in `BRAND` meets WCAG AA
-* (≥ 4.5:1) against every surface token it is allowed to sit on. That is
-* not a claim, it is `brand-doctor` rule 8, which computes the ratios.
-* The weakest legal pairing is `steelDim` on `ink800` at 5.00:1.
-*/
-/**
-* The two brand hues plus the neutral they sit on.
-*
-* GOLD IS SCARCE. It means forged / certified / earned / decisive — the
-* primary mark, the FORGED state, one call to action. It is not a paint
-* bucket: gold as default text, default border or default heading is a
-* brand-doctor finding, not a style choice.
-*
-* AURORA is verification energy — the secondary, and the hue that marks
-* the runtime half of the trust ladder.
-*/
-const BRAND = {
-	gold: "#C19A34",
-	goldBright: "#E6BD57",
-	goldHot: "#F4DC9C",
-	/** Pressed / deepest gold — the only step dark enough to carry white. */
-	goldDeep: "#A5811C",
-	aurora: "#37ABBD",
-	auroraBright: "#45C1D4",
-	auroraCyan: "#5CBDE0",
-	/** The aurora's outer curtains: atmosphere and section identity only,
-	* never a verdict or a status. */
-	auroraGreen: "#5FD6A4",
-	auroraViolet: "#9D8CF5",
-	steel: "#C8CBCF",
-	steelDim: "#8B939D"
-};
-/**
-* Midnight iron. One ramp, four steps, darkest first.
-*
-* `terminal` and `terminalBar` share one tone deliberately: the window's
-* only seam is a hairline ring and an inset shadow, never a second fill.
-* `chromeDot` is the three window dots — see the note on
-* `PENDING_TERMINAL.chromeDots` for why they are no longer red/amber/green.
-*/
-const SURFACE = {
-	ink950: "#0A1119",
-	ink900: "#0C1420",
-	ink850: "#111A29",
-	ink800: "#18243A",
-	/** Raised panel (cards, elevated surfaces). */
-	panel: "#141F33",
-	/** Soft fill (inline code, quiet chips). */
-	soft: "#1A2740",
-	/** Terminal body — the deepest tone, so a terminal reads as recessed. */
-	terminal: "#0A1119",
-	/** Terminal title bar — the same tone; the seam is shadow, not colour. */
-	terminalBar: "#0A1119",
-	/** The three window dots. One neutral, not a traffic light. */
-	chromeDot: "#18243A"
-};
-const TEXT = {
-	primary: "#EAEEF5",
-	secondary: "#ABB6C6",
-	muted: "#8B939D",
-	/** Ink for text set ON gold (buttons, the FORGED chip). 7.17:1 on `gold`. */
-	onGold: "#0A1119"
-};
-/**
-* Non-score status. `ok` is the one green in the system and it is NOT a
-* score colour — it survives only for contexts with no worthiness
-* meaning ("autofix applied", "analysis complete"). A green score would
-* say "your software is fine", which is the exact claim this product
-* refuses to make.
-*/
-const STATUS = {
-	ok: "#4FB477",
-	info: "#5CC4E0",
-	warning: "#E6BD57",
-	error: "#EC6B66"
-};
-/**
-* The four ScoreState bands plus the unmeasured state. Band thresholds
-* and runes live in `src/reporter/score-state.ts`, which stays free of
-* colour — it emits a palette KEY and each surface resolves it here.
-*
-* `unmeasured` is steel-dim on purpose. UNKNOWN is a legitimate answer,
-* not a failure: colouring it red would make "we did not measure this"
-* look like "this is broken", which is precisely the dishonesty the
-* north-star law exists to prevent.
-*/
-const SCORE = {
-	critical: "#EC6B66",
-	warning: "#E6BD57",
-	trusted: "#5CC4E0",
-	forged: "#F4DC9C",
-	unmeasured: "#8B939D"
-};
-/**
-* E0 → E1 → E2 is a certainty ramp, and it is deliberately HUE-FREE.
-*
-* Evidence level says how sure we are, not whether the news is good. A
-* deterministic proof (E2) is a defect we are certain about — painting
-* it gold or green would read as an achievement. So certainty is carried
-* by brightness alone, and the *shape* does the real work:
-*
-*     E0  open ring        observation, no weight
-*     E1  half-filled      pattern evidence, half weight
-*     E2  sealed           deterministic proof, full weight
-*
-* Colour never carries this alone (R11): the geometry is the signal and
-* survives `--ascii`, `NO_COLOR` and monochrome print.
-*/
-const EVIDENCE = {
-	e0: "#8B939D",
-	e1: "#ABB6C6",
-	e2: "#EAEEF5"
-};
-/**
-* L0–L5, and the most important boundary in the product.
-*
-* L0–L2 are STATIC: the neutral steel ramp, brightening to the static
-* ceiling at L2. L3–L5 require a real run, and the hue changes to aurora
-* exactly there. The boundary is a hue break, not a gradient step,
-* because it is a change of kind and not of degree — a static-only
-* finding can never climb past L2, however confident it is.
-*
-* Every surface that draws the ladder must draw that break.
-*/
-const TRUST = {
-	l0: "#8B939D",
-	l1: "#ABB6C6",
-	l2: "#C8CBCF",
-	l3: "#37ABBD",
-	l4: "#45C1D4",
-	l5: "#5CC4E0"
-};
-SURFACE.ink950, SURFACE.ink900, SURFACE.ink850, SURFACE.ink800, BRAND.steel, BRAND.steelDim, BRAND.gold, BRAND.goldBright, BRAND.goldHot, BRAND.aurora, BRAND.auroraBright, BRAND.auroraCyan, BRAND.auroraGreen, BRAND.auroraViolet;
-SCORE.trusted, SCORE.forged, SCORE.warning, SCORE.critical, STATUS.info, TEXT.onGold, STATUS.ok, EVIDENCE.e0, EVIDENCE.e1, EVIDENCE.e2, TRUST.l0, TRUST.l1, TRUST.l2, TRUST.l3, TRUST.l4, TRUST.l5;
-//#endregion
 //#region src/reporter/theme.ts
 /**
 * Norse-forge theme system. Pure string-in → string-out helpers.
@@ -12565,8 +13053,8 @@ SCORE.trusted, SCORE.forged, SCORE.warning, SCORE.critical, STATUS.info, TEXT.on
 *
 * Symbols always accompany color (color-blind safe, R11).
 *
-* Score-state colors come from ScoreState (score-state.ts) — the single
-* source of truth shared with the badge and (P2) the web.
+* Score-state colors come from ScoreState (presentation.ts) — the single
+* source of truth shared with the badge, the dashboard and the site.
 *
 * Terminal robustness (Master-Stabilization-Plan Sprint 5 Task 22):
 * box-drawing/gauge helpers accept an explicit width so callers can
@@ -13729,7 +14217,7 @@ function runForensics(target, options = {}) {
 		const base = stat.isFile() ? dirname(target) : target;
 		flakyMdPath = join(base, "FLAKY.md");
 		try {
-			writeFileSync(flakyMdPath, renderFlakyMd(report));
+			writeFileAtomic(flakyMdPath, renderFlakyMd(report));
 		} catch {
 			flakyMdPath = void 0;
 		}
@@ -14593,8 +15081,6 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 			skippedFiles++;
 			continue;
 		}
-		let fileBudgetExceeded = false;
-		let fileRuleFailed = false;
 		const relPath = relative(workspace.root, path).replaceAll("\\", "/");
 		if (!isCiAdapter) {
 			const lang = {
@@ -14620,79 +15106,106 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 		});
 		let cacheKey = fileCacheKey(rulesDigest, text, identity(wantsAst ? "ast" : "regex"));
 		const cachedFindings = cache.lookup(cacheKey);
-		if (cachedFindings) {
-			for (const f of cachedFindings) findings.push(f);
-			analyzed++;
-			continue;
-		}
-		hooks.onProgress?.({
-			phase: "parse",
-			done: scanned,
-			total: testFiles.length,
-			detail: relPath
-		});
-		const parsedFile = {
-			path: relPath,
-			text
-		};
-		let parsed;
-		const findingsStart = findings.length;
-		try {
-			if (adapter.parseAst && wantsAst) {
-				hooks.onProgress?.({
-					phase: "rules",
-					done: scanned,
-					total: testFiles.length,
-					detail: relPath
-				});
-				parsed = await adapter.parseAst(parsedFile);
-			}
-			const actualMode = parsed ? "ast" : "regex";
-			if (wantsAst && actualMode === "regex") {
-				parseFallbacks++;
-				cacheKey = fileCacheKey(rulesDigest, text, identity(actualMode));
-				const fallbackFindings = cache.lookup(cacheKey);
-				if (fallbackFindings) {
-					for (const f of fallbackFindings) findings.push(f);
-					analyzed++;
-					continue;
+		const executor = createExecutor("sequential", 1, async (job) => {
+			if (job.cacheHit !== void 0) return {
+				path: job.path,
+				status: "CACHE_HIT",
+				findings: [...job.cacheHit],
+				parseFallback: false
+			};
+			let parseFallback = false;
+			let fileRuleFailed = false;
+			let fileBudgetExceeded = false;
+			let parsedAst;
+			try {
+				if (adapter.parseAst && job.wantsAst) {
+					hooks.onProgress?.({
+						phase: "rules",
+						done: scanned,
+						total: testFiles.length,
+						detail: job.path
+					});
+					parsedAst = await adapter.parseAst({
+						path: job.path,
+						text: job.text
+					});
 				}
-			}
-			const fileForRules = parsed ? {
-				...parsedFile,
-				ast: parsed.ast
-			} : parsedFile;
-			adapter.runRules(activeRules, fileForRules, (f, ruleId, category) => {
-				if (!isValidFindingRecord(f)) {
-					fileRuleFailed = true;
-					onRuleCrash?.(ruleId, relPath, /* @__PURE__ */ new Error(`malformed finding record rejected (severity/line/message must be present, severity ∈ error|warning|info): ${JSON.stringify(f)}`));
-					return;
+				const actualMode = parsedAst ? "ast" : "regex";
+				if (job.wantsAst && actualMode === "regex") {
+					parseFallback = true;
+					parseFallbacks++;
+					cacheKey = fileCacheKey(rulesDigest, job.text, identity(actualMode));
+					const fallbackFindings = cache.lookup(cacheKey);
+					if (fallbackFindings) return {
+						path: job.path,
+						status: "CACHE_HIT",
+						findings: [...fallbackFindings],
+						parseFallback: true
+					};
 				}
-				findings.push({
-					...f,
-					ruleId,
-					category
+				const fileForRules = parsedAst ? {
+					path: job.path,
+					text: job.text,
+					ast: parsedAst.ast
+				} : {
+					path: job.path,
+					text: job.text
+				};
+				const produced = [];
+				adapter.runRules(activeRules, fileForRules, (f, ruleId, category) => {
+					if (!isValidFindingRecord(f)) {
+						fileRuleFailed = true;
+						onRuleCrash?.(ruleId, job.path, /* @__PURE__ */ new Error(`malformed finding record rejected (severity/line/message must be present, severity ∈ error|warning|info): ${JSON.stringify(f)}`));
+						return;
+					}
+					produced.push({
+						...f,
+						ruleId,
+						category
+					});
+				}, (ruleId, error) => {
+					fileRuleFailed = true;
+					onRuleCrash?.(ruleId, job.path, error);
+				}, {
+					deadline: Math.min(deadline, Date.now() + LIMITS$1.maxFileAnalysisMs),
+					onExceeded: () => {
+						rulesPartial = true;
+						skippedFiles++;
+						truncationReasons.add("file-budget");
+						fileBudgetExceeded = true;
+					}
 				});
-			}, (ruleId, error) => {
-				fileRuleFailed = true;
-				onRuleCrash?.(ruleId, relPath, error);
-			}, {
-				deadline: Math.min(deadline, Date.now() + LIMITS$1.maxFileAnalysisMs),
-				onExceeded: () => {
-					rulesPartial = true;
-					skippedFiles++;
-					truncationReasons.add("file-budget");
-					fileBudgetExceeded = true;
-				}
-			});
-			if (!fileRuleFailed && !fileBudgetExceeded) analyzed++;
-			if (!fileRuleFailed) cache.store(cacheKey, findings.slice(findingsStart), fileBudgetExceeded);
-		} catch {
-			if (wantsAst) parseFallbacks++;
-			skippedFiles++;
-			parseFailed++;
-		} finally {
-			parsed?.dispose();
+				if (!fileRuleFailed && !fileBudgetExceeded) analyzed++;
+				if (!fileRuleFailed) cache.store(cacheKey, produced, fileBudgetExceeded);
+				return {
+					path: job.path,
+					status: "OK",
+					findings: produced,
+					parseFallback
+				};
+			} catch {
+				if (job.wantsAst) parseFallbacks++;
+				skippedFiles++;
+				parseFailed++;
+				return {
+					path: job.path,
+					status: "FAILED",
+					findings: [],
+					parseFallback
+				};
+			} finally {
+				parsedAst?.dispose();
+			}
+		});
+		const outcome = (await executeFiles([{
+			path: relPath,
+			text,
+			wantsAst,
+			...cachedFindings !== void 0 ? { cacheHit: cachedFindings } : {}
+		}], executor))[0];
+		if (outcome?.status === "CACHE_HIT" || outcome?.status === "OK") {
+			for (const f of outcome.findings) findings.push(f);
+			if (cachedFindings !== void 0 && outcome.status === "CACHE_HIT") analyzed++;
 		}
 	}
 	return {
@@ -14783,12 +15296,16 @@ function applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, dec
 	const runtimeReportPath = discoveredReport?.path;
 	const runtimeIncomplete = discoveredReport !== void 0 && discoveredReport.report.analysisComplete !== true;
 	let forensicVerdicts;
+	let evidenceRecords = [];
 	if (discoveredReport && discoveredReport.report.analysisComplete === true) try {
-		buildEvidenceRecords(discoveredReport.report, discoveredReport.path);
+		evidenceRecords = buildEvidenceRecords(discoveredReport.report, discoveredReport.path);
 		stampRuntimeCorroboration(findings, discoveredReport.report, workspace.root);
 		forensicVerdicts = summarizeForensicVerdicts(discoveredReport.report);
-	} catch {}
+	} catch {
+		evidenceRecords = [];
+	}
 	return {
+		evidenceRecords,
 		testDeclarationCount,
 		scopeInfo,
 		suppressionCount,
@@ -14931,6 +15448,8 @@ function assembleScanResult(o) {
 		...o.runtimeIncomplete !== void 0 ? { runtimeIncomplete: o.runtimeIncomplete } : {},
 		identityIncomplete
 	});
+	const repository = bindRepository(o.scanRoot.root);
+	const candidate = readCandidateBinding(o.scanRoot.root);
 	const runIdentity = buildRunIdentity({
 		files: inputSnapshot,
 		rules: [...o.REVISION_BY_RULE_ID.entries()].map(([id, detectorRevision]) => ({
@@ -14943,9 +15462,17 @@ function assembleScanResult(o) {
 		trustModelVersion: TRUST_MODEL_VERSION,
 		scoringModelVersion: SCORING_MODEL_VERSION,
 		frameworkSupportMatrixVersion: FRAMEWORK_SUPPORT_MATRIX_VERSION,
-		evidenceSchemaVersions: [1]
+		evidenceSchemaVersions: [1],
+		...repository,
+		...candidate !== null ? { candidate } : {}
+	});
+	const evidenceGraph = buildEvidenceGraph({
+		runId: runIdentity,
+		...candidate !== null ? { candidate: {
+			manifestId: candidate.manifestId,
+			candidateSha: candidate.candidateSha
+		} } : {}
 	});
-	const evidenceGraph = buildEvidenceGraph({ runId: runIdentity });
 	const hasTests = o.testFileCount > 0 && o.testDeclarationCount > 0;
 	const suiteInvalidatedBy = [...new Set(o.findings.filter((f) => SUITE_INVALIDATING_RULE_IDS.has(f.ruleId)).map((f) => f.ruleId))].sort();
 	const finalScore = hasTests ? completion.partial && scopeAdjustedTotal >= 100 ? 99 : scopeAdjustedTotal : null;
@@ -14955,6 +15482,11 @@ function assembleScanResult(o) {
 		scopeIntegrity,
 		runIdentity,
 		evidenceGraph,
+		evidence: {
+			records: o.evidenceRecords ?? [],
+			counts: countEvidence(o.evidenceRecords ?? []),
+			artifact: o.runtimeReportPath ?? null
+		},
 		score: finalScore,
 		...hasTests ? {} : { reason: "no-tests-found" },
 		frameworks: o.frameworks.frameworks,
@@ -16337,6 +16869,133 @@ async function handleStdioLine(line, write) {
 	write(`${JSON.stringify(response)}\n`);
 }
 //#endregion
+//#region src/integrations/sentry.ts
+/**
+* Sentry crash reporting — opt-in, and inert unless a DSN is configured.
+*
+* Why opt-in: Mjölnir ships as an `npx` CLI over other people's private
+* repositories. A tool that reads a codebase must never phone home on its
+* own, so the ONLY switch is an explicit `SENTRY_DSN` in the environment.
+* Absent that, every function here returns immediately and `@sentry/node` is
+* never imported — zero network, zero added startup cost on a path whose
+* whole selling point is scan speed.
+*
+* Why an optional peer dependency: `@sentry/node` is ~1.5 MB unpacked and
+* nothing in a code scanner needs it. Making it a hard `dependency` would
+* tax every install for a feature most users never turn on, so it is an
+* optional peer: installs on request (`npm i @sentry/node`), absent by
+* default, and a missing module is handled as "reporting unavailable"
+* rather than as a crash.
+*
+* Capture points are deliberately the two EXISTING top-level catch blocks
+* (cli.ts entry, mcp/stdio.ts) rather than `process.on("uncaughtException")`
+* / `("unhandledRejection")` handlers. Registering those would silently
+* change the CLI's frozen exit-code contract (§24.1) and could keep a
+* process alive after a fatal error. One capture point per surface is
+* enough to answer "did Mjölnir itself break, and where".
+*
+* What is deliberately NOT sent: no user data (`sendDefaultPii: false`), no
+* traced request/span data (`tracesSampleRate: 0` — a batch CLI has no
+* request to trace), no console breadcrumbs, and no scan findings or file
+* contents. Events carry the error, its stack, the release, and the surface
+* that raised it.
+*/
+/** The loaded SDK, or null while reporting is off/unavailable. */
+let sdk = null;
+/**
+* Flush budget for the process-exit paths. Long enough for one HTTPS
+* envelope on a slow link, short enough that a broken network cannot turn
+* a crashed CLI into a hung one. Sentry's own default is 2s.
+*/
+const FLUSH_TIMEOUT_MS = 2e3;
+/** Writes a diagnostic without touching stdout. */
+function warn(message) {
+	process.stderr.write(`mjolnir: sentry — ${message}\n`);
+}
+/**
+* The release name Sentry groups events under. Matches the npm package
+* name so a release created from a tag and a release reported by the SDK
+* are the same release, not two half-populated ones.
+*/
+const SENTRY_RELEASE = `mjolnir-qa@${ENGINE_VERSION}`;
+/**
+* Resolve the environment tag. Unset means "a developer's machine" unless
+* CI says otherwise: a `npx` run is not a production event, and filing
+* those under `production` would poison the issue stream with noise from
+* end users triaging their own repos.
+*/
+function resolveEnvironment() {
+	const fromEnv = process.env.SENTRY_ENVIRONMENT?.trim();
+	if (fromEnv) return fromEnv;
+	return process.env.CI ? "ci" : "local";
+}
+/**
+* Turn reporting on if — and only if — a DSN is configured. Safe to call
+* from every entry point: the second call is a no-op that returns the
+* already-decided answer, so a process that reaches two surfaces cannot
+* initialize the SDK twice.
+*
+* Returns true when reporting is live. Never throws: a monitoring
+* integration that can take down the tool it monitors has failed at its
+* one job.
+*/
+async function initSentry() {
+	if (sdk) return true;
+	const dsn = process.env.SENTRY_DSN?.trim();
+	if (!dsn) return false;
+	let loaded;
+	try {
+		loaded = await import("@sentry/node");
+	} catch {
+		warn("SENTRY_DSN is set but @sentry/node is not installed. Install it with: npm install @sentry/node");
+		return false;
+	}
+	try {
+		loaded.init({
+			dsn,
+			release: SENTRY_RELEASE,
+			environment: resolveEnvironment(),
+			tracesSampleRate: 0,
+			sendDefaultPii: false,
+			attachStacktrace: true
+		});
+	} catch (error) {
+		warn(`SDK init failed (${error instanceof Error ? error.message : String(error)}). Crash reporting stays off.`);
+		return false;
+	}
+	sdk = loaded;
+	return true;
+}
+/**
+* Report one fatal error. `surface` names the entry point that raised it
+* ("cli" or "mcp") so the issue stream can be split by how Mjölnir was
+* being used when it broke. A non-Error throw is reported as-is rather
+* than dropped: a hostile throw value is exactly the case worth seeing.
+*/
+function captureInternalError(error, surface) {
+	if (!sdk) return;
+	try {
+		sdk.captureException(error, { tags: { surface } });
+	} catch (captureError) {
+		warn(`capture failed (${captureError instanceof Error ? captureError.message : String(captureError)}).`);
+	}
+}
+/**
+* Deliver anything buffered before the process exits. Awaits the SDK's
+* own transport drain and returns whether the envelope was handed off;
+* the caller is on an exit path, so the answer is deliberately not
+* surfaced as a failure — a lost crash report must not change the exit
+* code a caller (or CI) is about to read.
+*/
+async function flushSentry(timeoutMs = FLUSH_TIMEOUT_MS) {
+	if (!sdk) return false;
+	try {
+		return await sdk.flush(timeoutMs);
+	} catch {
+		return false;
+	}
+}
+//#endregion
 //#region src/mcp/stdio.ts
 /**
 * The standalone MCP stdio binary (blueprint §21), built to
@@ -16355,9 +17014,14 @@ async function handleStdioLine(line, write) {
 * subprocess coverage cannot merge into the parent istanbul report,
 * same class as dist/**), so it is excluded from the coverage ratchet.
 */
-runStdioTransport(process.stdin, process.stdout).then(() => process.exit(0)).catch((err) => {
+initSentry();
+runStdioTransport(process.stdin, process.stdout).then(() => process.exit(0)).catch(async (err) => {
+	captureInternalError(err, "mcp");
+	await flushSentry();
 	process.stderr.write(`mjolnir mcp fatal: ${err instanceof Error ? err.message : err}\n`);
 	process.exitCode = 20;
 });
 //#endregion
 export {};
+
+//# sourceMappingURL=stdio.mjs.map