mjolnir-qa 3.0.0 → 5.0.0

package/CHANGELOG.md

@@ -11,12 +11,598 @@ once shipped, so this file is the record of what changed between versions.
 
 ## [Unreleased]
 
+## [5.0.0] — 2026-09-27
+
+### Breaking changes
+
+- **`business-case` no longer prints a dollar figure you did not supply.** The
+  `--industry` flag selected from a table of invented incident costs (fintech
+  $50 000, healthcare $100 000, …) with no source, and the product of that table
+  and a measured false-positive rate was printed as "Expected Savings" and
+  "Total potential savings". Pass `--incident-cost <n>` to see the arithmetic;
+  the measured FP rates, their sample sizes and the evidence weight behind them
+  are always shown. `--industry`, `--history` and `--projected` now exit with a
+  reason: `--history` read no history despite promising estimates from scan
+  improvements, and `--projected` divided the total by six and called the
+  quotient a monthly rate.
+- **`enterprise sso` and `enterprise compliance` no longer write files.** They
+  wrote an SSO guide instructing readers to add an `sso` block to
+  `mjolnir.config.json` — a key nothing reads — and three auditor-facing SOC 2 /
+  HIPAA / PCI-DSS templates mapping controls to capabilities this product does
+  not have (SSO/SAML integration, a scan "audit trail", a "privacy scan"). Both
+  now refuse with a reason. `enterprise config` emits
+  `capability-manifest.json`, whose `notProvided` list records the absences
+  instead of inventing a deployment.
+- **The evidence descriptor is now the same on every surface.** The HTML and
+  Markdown trust reports showed four bare words (`E2 · deterministic`) where the
+  terminal showed the full descriptor. They now show
+  `[E2 · deterministic · measured FP 8% · n=14 · trust L3 · runtime: file executed]`.
+  A finding with no `evidenceLevel` of its own now derives one from its type and
+  confidence instead of defaulting to `E2` — the strongest claim the product can
+  make, previously asserted for findings nobody had measured.
+- **Unmeasured counts read "unknown — not measured", not `0`.** The trust
+  report, the PR comment and the step summary all rendered
+  `testDeclarationCount ?? 0` as "0 tests analyzed in 0 files" for a producer
+  that had never measured a declaration. The trust-report JSON twin now emits
+  `null` for those fields. A zero is a claim; an absent measurement is not.
+- **The dashboard no longer varies between runs of an unchanged repository.**
+  The generation timestamp moved out of the visible body into
+  `<meta name="mjolnir-generated-at">`, and `--deterministic` omits it entirely
+  so the artifact is byte-identical and can be diffed in review.
+- **`mjolnir report` no longer publishes a test-run status.** The top-level
+  `status` was computed from the findings
+  (`partial ? "interrupted" : hasError ? "failed" : "passed"`), so a clean scan
+  wrote `{status: "passed", totalTests: 0}` — the first field a Playwright
+  consumer reads, asserting a green run over zero executed tests, with the
+  contradicting `execution: "STATIC_ANALYSIS"` marker buried in the extension
+  block. `failed` was equally dishonest: it implies tests ran and lost. The
+  field is now the literal `interrupted` on every path, and what the scan
+  actually found is reported separately as
+  `mjolnir.scanOutcome` (`clean` / `blocked` / `partial`), which the previous
+  `mjolnir.status` field carried. Consumers reading the root `status` will see
+  `passed` → `interrupted`; that is the correction, not a regression.
+- **Score bands are decided in one place.** The dashboard split at 60 while the
+  terminal split at 80, so a score the terminal called UNWORTHY rendered amber
+  in HTML; the contributor handover used 90; `mermaid.ts` and
+  `monorepo-analysis.ts` each carried their own copy. All of them now read
+  `src/reporter/presentation.ts`.
+
+### Added
+
+- **`npm run ci:standard` now runs in CI.** `scripts/check-ci-standard.mjs`
+  was unit-tested by `tests/integrations/ci-standard.spec.ts` but referenced
+  by no workflow, so the invariants it checks — the PR scan's partial-analysis
+  handling, the coverage and ratchet gates, and the read-only scan job's
+  permissions — were enforced nowhere. It runs as a step in `workflow-lint`,
+  next to actionlint, since both are static checks of the repo's own CI
+  config.
+
+- **Opt-in Sentry crash reporting.** Set `SENTRY_DSN` and the CLI and the MCP
+  stdio server report their own fatal errors — release-tagged as
+  `mjolnir-qa@<version>`, tagged by surface, and nothing else: no user data
+  (`sendDefaultPii: false`), no traced spans (`tracesSampleRate: 0`), no
+  findings or file contents. With no DSN the SDK is never even imported, so the
+  default install gains no dependency, no startup cost, and no network call. A
+  tool that reads private repositories must not phone home on its own, so the
+  DSN is the only switch. `@sentry/node` is an OPTIONAL peer dependency for the
+  same reason: ~1.5 MB that nothing in a code scanner needs. Capture points are
+  the two existing top-level catch blocks rather than `uncaughtException` /
+  `unhandledRejection` handlers, which would have changed the frozen exit-code
+  contract. `npm run sentry:release` creates the release and uploads source maps
+  (the build now emits them; the published tarball still excludes them). Both
+  release pipelines now run it after `npm run build` and before `npm pack`,
+  because the debug ids it stamps are written into `dist/` in place: pack first
+  and the shipped tarball carries no ids, so the maps uploaded for the release
+  match nothing and every stack trace degrades to a bundle frame.
+- `npm run report:honesty` — no surface may print a zero for a measurement that
+  may be absent. Four reviewed exceptions are recorded for computation inputs,
+  each with a reason and a follow-up.
+- `npm run thresholds:parity` — no score-band literal may exist outside the
+  threshold registry. It immediately caught a selector-health threshold that
+  shared a number with a trust band but not a meaning.
+- `npm run claims:revalidate` — every claim asserted `fixed` must rest on a
+  candidate-bound, independent revalidation. It rejects evidence that cites the
+  artifact it is meant to prove, and downgrades rather than deleting a claim
+  that loses its evidence.
+- `npm run verbs:budget` — the 5.x law, ratcheted at 50 verbs with a 44 target
+  for 5.0.
+- `npm run script:paths` — no `package.json` script may name a `tests/`,
+  `src/`, `scripts/`, `docs/`, `site/` or `enterprise/` path that does not
+  exist. 107 path references are checked today.
+- `npm run m26:gaps:revalidate` — re-runs every gap row's own
+  `revalidation_command` against the working tree and records the exit code and
+  the commit it ran at.
+- `tests/contract/artifact-determinism.spec.ts` — two runs of the HTML
+  artifact over an unchanged repository must be byte-identical.
+- `src/reporter/presentation.ts` — the one module that makes a presentation
+  decision. It reads a finding, a score or a palette and returns the word, band
+  or descriptor to print. It opens no file, touches no clock and formats no
+  document, and a test enforces that.
+
 ### Changed
 
-- **Advisory-first CI adoption** — `mjolnir ci install` and the root
-  GitHub Action now default to non-blocking findings and non-blocking partial
-  scans. Blocking remains explicit through `--gate error`, `--gate warning`,
-  or `fail-on`.
+- **Ruleset `01` now enforces 11 required checks instead of 4.** It required
+  only the four `build-test` matrix contexts, which meant the repo's entire
+  review surface — self-scan, certification, generated-docs-drift, site-build,
+  workflow-lint, property, fuzz — could be red while a PR still merged. That
+  made every one of those checks advice rather than a gate, and it meant the
+  deleted `merge-verify.yml` header was describing a ruleset that never
+  existed. The enforced set is now the four matrix entries plus
+  `property-tests`, `fuzz`, `site-build`, `workflow-lint`, `self-scan`,
+  `certification` and `generated-docs-drift` — every check that can actually
+  block. Deliberately still _not_ required: `detector-revision-diff` (advisory
+  by design — a hard fail would only manufacture routine revision bumps),
+  `scan` / `publish` (the Mjölnir PR report, which reviewers read but which
+  duplicates `self-scan` on the `src` tree), and the CodeQL/OSV workflows,
+  which report but do not gate. `strict_required_status_checks_policy` and
+  `do_not_enforce_on_create` are preserved, so a PR must still be current with
+  `main` to merge.
+- **`docs/BRANCH-PROTECTION.md` now states the enforced set instead of an
+  aspiration.** It listed eight required checks; three of them were enforced.
+  Its verification command also read `branches/main/protection`, which does not
+  carry required checks at all on this repo — they live in ruleset `01` — so it
+  could not have worked. Both are corrected.
+
+### Removed
+
+- **The Snyk webhook is gone.** Snyk posted a `security/snyk (sergey-bar)`
+  commit status on every push, duplicating the first-party `osv-scanner.yml`
+  (`scan-pr` / `scan-scheduled`) and the Dependabot security updates that are
+  already configured. Repo webhooks are now empty. Restore with Snyk's own
+  integration settings if it is ever wanted back — the deleted hook pointed at
+  `https://api.snyk.io/webhook/github/4ac3f376-3f24-42f7-a2c4-8830700f671d`.
+- **The `merge-verify` workflow is gone.** It re-ran the entire PR gate
+  (build, typecheck, lint, coverage, property, fuzz, site, self-scan, docs
+  regen) on every push to `main` — roughly doubling CI cost. Its stated
+  justification was that "a green PR that merges into a red main is not a
+  green PR", but that failure class is already closed by ruleset `01` running
+  `strict_required_status_checks_policy`, which refuses to merge a PR that is
+  not current with `main`. The file also asserted that ruleset `01` "requires
+  the complete PR matrix, property/fuzz, site, workflow-lint, self-scan,
+  certification, detector-revision, and generated-docs checks before merge" —
+  it did not, and never has. The ruleset requires only the four `build-test`
+  matrix contexts. Both the workflow and the claim are removed rather than left
+  to mislead a reviewer about what blocks a merge.
+- **The `bench-advisory` CI job is gone.** It spent a full `npm ci` plus a
+  3 000-file benchmark run on every PR to produce a comparison that
+  `continue-on-error: true` then discarded, and whose only output was a
+  warning nobody could gate on. `npm run bench:scan`, the pinned
+  `.mjolnir/bench-baseline.json`, and their schema/comparison tests in
+  `tests/adversarial/bench-gate.spec.ts` are untouched — the benchmark is
+  still runnable and still tested, it just no longer costs every PR a runner.
+- **Four copies of the soft job time-budget report.** Each of `build-test`,
+  `self-scan`, `generated-docs-drift` and `bench-advisory` re-derived its own
+  wall-clock minutes into `$GITHUB_STEP_SUMMARY` and printed a warning that,
+  by its own comment, "never gates". The jobs already declare
+  `timeout-minutes`, which is the hard bound, and GitHub reports job duration
+  natively.
+
+### Fixed
+
+- **Order in the report no longer depends on the machine that produced it.** 23
+  sites in `src/` sorted with a bare `localeCompare`, which resolves against the
+  process's default locale. `scan-cache.ts` was the worst: it sorted INSIDE
+  `hashDir`, so the order was fed to `hash.update(entry.name)` and became a
+  semantic input to the detector fingerprint that `isIncrementalSafe` keys off
+  — one repository, two fingerprints, one per locale. All 23 now use
+  `compareCodePoints` from `src/lib/compare.ts`, except two whose key is a
+  human-readable label, which use a comparator pinned to `en` rather than
+  inheriting the environment. `tests/contract/deterministic-ordering.spec.ts`
+  fails the build on any unpinned `localeCompare` in `src/`.
+- **`mjolnir bind` can no longer be hijacked by a repository's own `git`.**
+  `src/engine/candidate-binding.ts` — called on every scan — ran
+  `execFileSync("git", …)` with a bare name. On Windows `CreateProcess` searches
+  the current directory before `PATH`, so a committed `git.exe` in an untrusted
+  repo chose the `commit` and `tree` that land in `runIdentity` and the evidence
+  graph. It is the last bare-name process launch left in `src/`, and
+  `tests/contract/no-bare-process-exec.spec.ts` now audits the whole tree.
+- **The coverage exemption ledger can no longer drift silently.** Each
+  non-structural entry in `docs/COVERAGE-EXEMPTIONS.json` now carries
+  `defectSignatures` — regexes that must still match its file — or an explicit
+  `closureState` when the defect it described is gone. A signature that stops
+  matching fails the gate, so a code fix forces a ledger edit in the same
+  commit. Six entries were already describing defects the current code had
+  fixed (`maturity`, `business-case`, `dashboard`, `enterprise`, `exec-report`
+  and the `report-playwright` row), and are reclassified accordingly.
+- **Skipped and expected-fail tests now have a price.** Nothing in the
+  repository counted them, so the count could grow from zero to hundreds with
+  every other signal still green. `docs/SKIP-BUDGET.json` records the current
+  counts — 8 skipped tests, 1 skipped file, 3 expected failures — measured by
+  `scripts/vitest-skip-budget-reporter.mjs` during the run. They may fall;
+  raising them fails `npm run skip:budget` and names the tests that spent the
+  budget. A missing or incomplete measurement fails too, so a reporter that
+  stops being wired in cannot read as a clean run.
+- **The M26 release gate and the version-drift checks are covered where it
+  matters.** Both run inside `certify` and both were excluded from the coverage
+  ratchet, so their reject arms — the paths that only execute when something is
+  wrong — had no reviewer pressure on them. `tests/ledger/m26-validator-reject-arms.spec.ts`
+  is table-driven over every required field, so a field that is added without a
+  test fails; `tests/release/version-surface-drift-arms.spec.ts` covers the
+  fail-fast arms of the version synchronizer.
+- **One error derivation, one `isRecord`, one crash-isolation path.** The tree
+  carried `isRecord` eight times (seven byte-identical), error rendering four
+  times under two names, and crash isolation seven times — and the copies
+  disagreed, which is the only reason any of this mattered. `String(obj)`
+  renders `[object Object]`, so the two _thinner_ error helpers turned a real
+  Node failure shape like `throw { code: "EISDIR" }` into a message naming
+  nothing — in a doctor detail, an MCP tool result and a `summary` line
+  respectively. The richer body survived the collapse, and
+  `isRecord` — the predicate every JSON reader uses to decide "this is an
+  object I may index into", which is a question a hostile saved report gets
+  to ask — is now the exported one in `src/lib/safe-json.ts`. The four
+  adapters' duplicated `try { rule.run } catch { onCrash }` is now
+  `runRuleIsolated`, because that block is what the `rulesCrashed` count is
+  built on and seven copies mean seven chances to lose it.
+  The per-adapter _filter chain_ and budget check were deliberately **not**
+  folded into the existing `runRulesShared`: the TypeScript adapter injects
+  an AST, framework tags, a lazy `codeText` getter, config-only gating and
+  `configGateMatches`, and it _aborts the whole file_ on budget exhaustion
+  where `runRulesShared` only skips one rule. Routing every adapter through
+  it as written would have silently changed which rules run — the exact
+  unmeasured claim this program exists to delete.
+  `tests/contract/single-error-helper.spec.ts` holds the counts at one, and
+  pins the object arm so a future "simplification" cannot drop it.
+
+- **A crashed rule is no longer certified as a rule that stayed silent.**
+  The doc generator caught a rule THROW while running it against its own
+  must-not-fire fixture and returned `null`; the caller read that as
+  `fired: false` and committed, into a generated doc page and the
+  certification surface, the sentence _"Verified against … — a legitimate,
+  similar-looking pattern this rule correctly leaves alone."_ A detector that
+  crashes produces exactly the same absence of findings as one that correctly
+  abstains, so that claim had no evidence behind it — and it contradicted the
+  same function's own docstring, which says the field degrades honestly.
+  The outcome is now the tri-state the doctor's own model already defines:
+  `FIRED` (a real firewall violation), `DID_NOT_FIRE` (certified), and
+  `INCONCLUSIVE` (the rule did not run). An `INCONCLUSIVE` page says so and
+  says why, and it never renders the certification sentence. A missing
+  fixture is a fourth, separate thing — nothing was attempted — and says
+  that instead. The field is typed as a `FixtureOutcome` union rather than a
+  boolean, so reintroducing a derived `fired` flag does not typecheck.
+
+- **A human-facing table stopped sorting by code unit.** Pinning every
+  `localeCompare` to code-unit order (the fix for the ambient-locale drift)
+  made the per-rule corpus-occurrence table read
+  `SeleniumHQ-selenium` before `microsoft-playwright-dotnet`, because `S`
+  sorts before `m`. Stable, and worse to read than the alphabetical order the
+  table implies it has. That surface is a table a person chooses repos from,
+  so it now uses an **explicitly pinned** locale — readable order, identical
+  on every machine, which is the actual defect being avoided.
+
+- **Fifteen silent capability losses are now counted, and the count reaches the
+  report.** A `catch` in a detection path that returned a clean default made
+  the scan exit 0, report `analysisComplete`, and quietly lose the thing that
+  made its verdict trustworthy — the reader had no way to tell a whole scan
+  from a narrowed one. The worst case was `getCodeOnlyText` returning raw text
+  after a throw, which switches OFF the comment/string false-positive firewall
+  for that file rather than merely slowing it down. Every such site now records
+  a reason in one append-only ledger (`src/engine/degradation-ledger.ts`),
+  following the precedent already set by `parserRetryDegradationCount`, and the
+  scan result carries `analysisStatus.degradations` — reason-coded counts,
+  present only when something was actually lost, alongside a
+  `degraded:<reason>:<count>` entry in `reasons`. A non-empty set makes the
+  scan `partial`. `truncationReasons` is untouched: a degradation is not
+  truncation, and a reader must be able to tell "the scan stopped" from "the
+  scan lost a layer".
+  - Two distinctions the ledger refuses to blur. **Absent is not degraded:** a
+    Python, Java, Go or Rust repository has no `package.json`, and recording
+    that would mark every non-Node project partial while training readers to
+    ignore the field — so only a manifest that exists and will not parse
+    counts. **A no-AST adapter is not a downgrade either:** the same line
+    W1.4 draws for the deadline fallback.
+  - Two sites outside the original list were found by the new contract spec
+    and fixed in the same commit: the tree-sitter Java/C#/Python parses (left
+    alone, because the pipeline already counts every `parseAst → undefined` as
+    one parse fallback, and counting again would tally one file twice in two
+    different fields) and `hashDir`'s `readdirSync`, whose early `return`
+    omitted a whole subtree from the detector fingerprint — two rule trees
+    differing only inside an unreadable directory then hash identically, which
+    is a stale-cache hit wearing a fresh one's clothes.
+  - `mjolnir trend show` no longer prints "No trend data yet." and exits clean
+    for a history file whose every line failed to parse. The count of
+    discarded lines is now reported on stderr, and a history that exists but
+    cannot be read is `EXIT_INTERNAL` — the difference between no history and
+    unreadable history, which both used to arrive as the same empty array.
+  - `mjolnir explain` distinguishes _the rule found nothing_ from _the rule
+    never ran_. A rule that THREW on its own fixture produced the same output
+    as a correctly silent one, in the one surface whose purpose is to show
+    that a rule works. It now says so, with the reason.
+  - `tests/contract/no-uncounted-degradation.spec.ts` is the durable half: a
+    `catch` in the detection path that RETURNS A VALUE must record a reason,
+    rethrow, route to a counted sink, or be exempted with a stated failure
+    direction. The rule is about the _return_, not the `catch` — 37 of the 70
+    detection-path catches return nothing and cannot lie to a caller, and a
+    spec that listed all 70 as individual exemptions would be the same as no
+    exemption list at all.
+
+- **Scanning a subdirectory no longer reports a framework it read from its
+  parent.** `runScan` walks up past the target to find the project root, and
+  re-anchors the scan root to the target when the target is a strict
+  descendant — but it kept the discovered root's parsed `package.json`. So
+  `mjolnir scan monorepo/packages/foo` reported `jest` because
+  `monorepo/package.json` said so: a read outside the explicit scan root, and
+  a framework verdict about a tree nobody pointed at. Framework detection now
+  works from in-root evidence only (config files and the anchor's own
+  manifest), and reports `frameworkDetectionUnknown` when that evidence is
+  absent — an absent verdict you can see, rather than a parent's you cannot.
+  Scanning the project root itself is unchanged. This is the CLI counterpart
+  to the containment property the MCP workspace-boundary contract already
+  enforced.
+- **A scan that ran out of time no longer loses its AST stage silently.** When a
+  scan passes `--max-duration`, the remaining files were analyzed by regex
+  instead of AST — a different detection capability, not a slower version of the
+  same one, so the same tree produced different findings and a different score.
+  The mode was faithfully recorded in the scan cache and reported nowhere; the
+  only nearby disclosure, `file-budget`, fired incidentally because the
+  per-file rule-loop deadline was usually already spent too. Such a scan now
+  carries the truncation reason `ast-budget-fallback` and an
+  `analysisStatus.reasons` entry `ast-budget-fallback-files:<n>` saying how many
+  files were analyzed by regex, and is honestly `partial`. An adapter that
+  declares no AST stage at all (a YAML workflow, for instance) is a declared
+  capability envelope and is NOT reported as truncation. `truncationReasons` is
+  an open `string[]` by design, so consumers should test for members rather than
+  assert the exact array.
+- **`frontier:contracts` was reporting 19 suites it never ran.** It named 24
+  test files; nineteen had been deleted by the `cc5fcb88` cleanup and its
+  follow-up. Vitest treats a missing path as "no tests here" rather than an
+  error, so the script exited 0 and printed "57 passed" while nineteen contract
+  suites — including every `m3x`/`m4x`/`m5x` frontier contract — silently did
+  not execute. A missing test file and a green test file are indistinguishable
+  from the outside, so a gate that passes because its subject is absent has
+  certified nothing. The list is rebuilt from the 23 contract suites that
+  exist (1 110 tests, not 57), and `npm run script:paths` now fails the build if
+  any `package.json` script names a path that is gone.
+- The certification ladder's language vocabulary could not name the answer its
+  own admission gate produces. `admit()` returns `UNMEASURED` as the supported
+  state of any claim not backed by evidence, but `LANGUAGE_STATE_RANK` had no
+  word for it — so a language claiming `CERTIFIED` with an empty cohort was
+  handed a result its own vocabulary could not record. `UNMEASURED` is now
+  expressible in both vocabularies, and the four rule-level states
+  (`MEASURED-CORE` … `PROVISIONAL`) are declared in `RULE_ONLY_STATES` as
+  explicitly _not_ language outcomes rather than being filtered out by a
+  hand-maintained list.
+- The contributor handover reported "Welcome aboard — the suite is in good
+  shape" whenever no issues were found, including when no run report had been
+  ingested and flakiness was therefore unmeasured. It now says what it did not
+  check.
+- The confidence table's row labels were encoded as `"k|v"` strings and split
+  back apart, so any value containing a pipe was silently truncated. The rows
+  are typed pairs. The table also gained a `<caption>`, a `<thead>` and
+  `scope` attributes; it was previously a bare `<tbody>` a screen reader
+  announced as six unlabelled rows.
+- `handoff` and `summary` each carried a private colourless score bar that
+  rendered 99 and 100 identically. Both now use the canonical `scoreGauge`, and
+  the redundant `theme.meter` alias is gone.
+- The gap ledger gained three revalidation statuses
+  (`ALREADY_FIXED` / `CONFIRMED_STILL_OPEN` / `STALE_UNVERIFIABLE`). A row may
+  no longer be cleared without a revalidation that was actually run at a named
+  commit, and `STALE_UNVERIFIABLE` deliberately does not clear a release gate —
+  an unverifiable claim must never be able to unblock a release.
+- `m26:github:sync` derived every one of 429 issue dispositions from GitHub's
+  own `state` field — a pure function of its input, containing no engineering
+  judgement — and `GAP-M26-002` then marked that script `fixed`, citing the
+  artifacts it produces. Dispositions now come from
+  `docs/issue-dispositions.json`, where each entry must carry a non-empty
+  reason and a verification naming a command or a source path, and may not be
+  verified by the script that wrote it. An untriaged issue stays open and is
+  flagged, never guessed and never silently closed. 215 of 429 are now visibly
+  awaiting a human decision, which is the honest count.
+
+### Documentation
+
+- `PRODUCT-ENHANCEMENT-ANALYSIS.md` is marked `SUPERSEDED-BY: BITTERSWEET` and
+  gained a section XII auditing its "all 16 features shipped" claims: six do not
+  hold (two shipped fabricated values, two shipped a different capability than
+  described, two never shipped). The document is kept as the record of what was
+  believed on 2026-09-20, because deleting it would destroy the only evidence
+  that the belief was wrong.
+- `docs/RELEASE-TRAINS.md` now records why each of the six scheduled verb
+  removals is justified differently, so the deprecation notices do not all send
+  the same message to users who acted on different output.
+
+## [4.0.0] — 2026-09-26
+
+The first release whose reporting surface is checked against the working tree
+rather than against a plan. Every box below is enforced by a gate in
+`npm run certify`.
+
+### What you get, relative to 3.0.0
+
+**The product no longer reports numbers it did not measure.**
+
+- [x] A scan that finished now says it finished. A minified bundle or a lockfile
+      in the repository used to downgrade a complete scan to `PARTIAL`, and the
+      terminal told you "some files were not analyzed, so the surface is
+      unverified" when every discovered test file _had_ been analyzed. Across
+      the 37-repository corpus, complete scans went from 13/37 to 29/37.
+- [x] Unmeasured counts read `unknown — not measured`, not `0`. The trust report,
+      the PR comment and the step summary all printed "0 tests analyzed in 0
+      files" for a producer that had never measured a test declaration. A zero
+      is a claim; an absent measurement is not.
+- [x] `handover` no longer tells you "the suite is in good shape" when no run
+      report was ingested and flakiness was therefore never checked. It now
+      names what it did not check.
+- [x] The HTML dashboard produces the same bytes for the same repository. It
+      embedded `new Date()` in its visible body, so it could never be diffed in
+      review. `--deterministic` omits the timestamp entirely.
+- [x] The trust report's evidence descriptor is the terminal's, on every surface.
+      HTML and Markdown showed four bare words (`E2 · deterministic`) where the
+      terminal showed the measured FP rate, the sample size, the trust rung and
+      what the runtime actually corroborated.
+- [x] A finding with no evidence level derives one from its own type and
+      confidence. It used to default to `E2` — the strongest claim the product
+      can make — for findings nobody had measured.
+- [x] The contributor handover no longer derives a dollar figure from a table of
+      invented incident costs. `business-case` multiplied a measured
+      false-positive rate by unsourced per-industry costs and printed the product
+      as "Expected Savings". A cost figure now requires `--incident-cost`, so the
+      number is yours. `--history` (which read no history) and `--projected`
+      (which divided by six) are gone, with reasons.
+- [x] `mjolnir enterprise` no longer writes a deployment config claiming
+      `sso-saml`, an SSO guide telling you to add a config key nothing reads, or
+      auditor-facing SOC 2 / HIPAA / PCI-DSS templates mapping controls to
+      capabilities this product does not have. `sso` and `compliance` refuse;
+      `config` emits a capability manifest whose `notProvided` list records the
+      absences.
+- [x] The dependency graph no longer prints a count derived from nothing.
+      "Reachable files: N" was always the number of files that went in.
+
+**The product now sees things it was blind to.**
+
+- [x] Node-native TypeScript tests (`.test.mts`, `.spec.mts`, `.test.cts`,
+      `.spec.cts`) are scanned. They were not mis-scored — they were never
+      scanned, so every rule was silent on them with no finding and no note.
+      Verified with two byte-identical tests: the `.ts` copy produced the
+      finding, the `.mts` copy produced nothing at all.
+- [x] The CI matrix installs cleanly on all three platforms. `npm ci` failed on
+      every job before a test ran, and then failed again with a missing
+      `lightningcss` binary for Linux, because a lockfile regenerated on Windows
+      cannot contain the other platforms' optional dependencies.
+
+**The gates now catch these instead of the next person.**
+
+- [x] `report:honesty` — no surface may print a zero for an absent measurement.
+      Four reviewed exceptions, each with a reason and a follow-up.
+- [x] `thresholds:parity` — no score-band literal outside the registry. It
+      immediately caught a selector-health threshold that shared a number with a
+      trust band but not a meaning.
+- [x] `script:paths` — no `package.json` script may name a path that is missing
+      or uncommitted. It found `frontier:contracts` naming 19 test files deleted
+      by an earlier cleanup: Vitest treats a missing path as "no tests here", so
+      the script exited 0 reporting "57 passed" while nineteen contract suites
+      never ran. Rebuilt from the 23 that exist — 1 110 tests, not 57.
+- [x] `lockfile:platforms` — the lockfile must carry the optional binaries for
+      every platform CI builds on. The failure is invisible locally by
+      construction, so it needed a gate that runs everywhere.
+- [x] `claims:revalidate` — a claim asserted `fixed` must rest on a
+      candidate-bound, independent revalidation. It rejects evidence citing the
+      artifact it is meant to prove, and downgrades rather than deletes a claim
+      that loses its evidence.
+- [x] `verbs:budget` — the 5.x law: one new verb requires one removal or a merge.
+- [x] `m26:gaps:revalidate` — re-runs each gap row's own command and records the
+      exit code and the commit it ran at.
+- [x] `release:verify` reports every blocker in one run. It was a `&&` chain, so
+      it stopped at the first of four and you met them one per run.
+- [x] The coverage gate is a floor and a ratchet, not one number pretending to
+      be both.
+
+**Truth in the project's own records.**
+
+- [x] The gap ledger was revalidated: all 17 rows had their own
+      `revalidation_command` run against this tree. `GAP-M26-005` read
+      `fixed` / PASS while its command _fails_. A cleared row can no longer
+      exist without a revalidation bound to a named commit, and
+      `STALE_UNVERIFIABLE` deliberately cannot unblock a release.
+- [x] **A gap row could be marked fixed while its own revalidation failed.**
+      The `exit_code === 0` check was reachable through only one of the four
+      combinations the schema allows, so a `fixed` row — or an
+      `ALREADY_FIXED` row carrying closure evidence — was accepted with
+      `exit_code: 1` recorded in its own revalidation. Three of those four
+      routes cleared the row. The test that covered it hid the hole, because
+      the fixture only set `closure_evidence` for `fixed`.
+- [x] The 429 GitHub dispositions no longer derive from GitHub's own `state`
+      field. A snapshot cannot prove itself; each disposition now needs a reason
+      and a verification. 215 issues are visibly awaiting a human decision,
+      which is the honest count.
+- [x] `PRODUCT-ENHANCEMENT-ANALYSIS.md` claimed 16 shipped features; six do not
+      hold. It is marked `SUPERSEDED-BY` and carries a per-feature audit, kept
+      rather than deleted because deleting it would destroy the only evidence
+      that the belief was wrong.
+
+**Found by the pre-release bug sweep, after the fix list was written.** Both
+were live in 3.0.0 and neither was in the plan.
+
+- [x] `mjolnir business-case <path>` answered a path that does not exist with
+      exit 0 and a clean report: "Measured: 0 of 0 findings carry a
+      corpus-measured FP rate". It called `runScan` directly and so never
+      passed through `validateScanTarget` — the check whose own comment says a
+      typo'd CI path must be a loud red, never a silent green. Thirteen of the
+      fifteen scanning verbs were already loud; this one was not, and a green
+      table over a path that was never scanned is the most dangerous output
+      this product can produce. Now exit 10.
+- [x] The extended TypeScript test-file regex was probed against 27 shapes:
+      all 12 that must match do, all 15 that must not are rejected —
+      including `a.min.mts`, `a.spec.cts.bak` and `notatest.mts`.
+- [x] `ships()` in `script:paths` was probed for the failure modes a new gate
+      usually has: an empty directory, a directory holding only untracked
+      files, and a symlink loop. All resolve correctly and none hangs. A
+      first version treated a directory as "tracked" only if `git ls-files`
+      listed the directory itself, which it never does — that produced two
+      false positives and is fixed.
+
+### Known open, deliberately
+
+- [ ] **Trust certification is not claimed, and this release was authorized
+      without it.** `candidate:readiness` reports `BLOCKED` /
+      `INCONCLUSIVE` on all ten of its checks — candidate identity is not a
+      release candidate, the candidate SHA is not authorized, engineering
+      certification is not complete, and external validation, protected holdout
+      proof, real-world repository proof, the platform matrix, consumer install
+      proof and remote workflow proof are all absent.
+      `m26:audit` is likewise unsatisfied. Both ran, both printed, and neither
+      blocked the publish, because `vars.STABLE_RELEASE_AUTHORIZED` is `true` —
+      the same explicit override 4.0.0 shipped under.
+      The distinction is the point: **publication of a package is not the same
+      claim as a certification of it.** 5.0.0 asserts that the reporting
+      surface is honest, that a silent capability loss is disclosed, and that no
+      verdict is published without a measurement behind it. It does not assert
+      that a holdout corpus, a platform matrix and an external validation run
+      have been completed, because none of them have.
+      Consumers are not asked to take that on trust: the npm package publishes
+      the candidate manifest, which reads `NOT_CERTIFIED` and
+      `NOT_AUTHORIZED`, and every one of those ten blockers is enumerated above
+      rather than summarised. Closing them is the work that would make a
+      certification claim possible; it is not work this release did.
+- [ ] `CERTIFICATION_STATES` is not in ladder order, so `rankOf` — the only
+      ordering function — ranks `KNOWN` above `TRUST-COMPLETE`, and
+      `requiresEvidence` asks `BLOCKED` and `DEGRADED` for a corpus their own
+      doc comment says they need none. Two `it.fails` tests record it, so
+      reordering the array fails the build. Fixing it moves `rankOf` for every
+      state and changes admission outcomes, so it is a contract change, not a
+      patch.
+- [ ] 23 corpus count-drifts are unreviewed, the largest being `QA-PY-007`
+      firing 1332 times in apache-airflow and 92 now. Not accepted: running
+      `--update` without reading them would delete the only evidence that
+      detection changed.
+- [ ] 8 of 37 corpus repositories report `PARTIAL` because test-support files
+      under `__tests__/` are not scanned. The verdict is honest — an incomplete
+      scan is not a pass — and the fix is a design decision about what "the
+      surface" means, not a patch.
+- [ ] 215 of 229 GitHub issues are untriaged. Prepared dispositions exist in
+      `docs/issue-dispositions.json`; none has been applied, because closing a
+      public issue is destructive and is a person's decision.
+- [ ] `BW-022` (one workspace model, real graph edges) is open. The plan claimed
+      it is "what makes `impact` honest"; it is not — `impact` never used the
+      graph and is honest on its own path. The graph is a no-op on an unshipped
+      code path, and the function now reports that instead of implying otherwise.
+
+### Upgrade notes
+
+- Node-native TypeScript test files are now scanned, so a project using
+  `.mts`/`.cts` tests **will see new findings**. That is the fix working, not a
+  regression.
+- `business-case` requires `--incident-cost` for any dollar figure, and now
+  exits 10 on a target that does not exist instead of printing an empty report.
+- `enterprise sso` and `enterprise compliance` now exit non-zero with a reason.
+- The trust report JSON's `tests.files` and `tests.declarations` are `null`
+  rather than `0` when unmeasured.
+
+## [4.0.0-rc.1] — 2026-09-25
+
+### Breaking changes
+
+- The next published version must be a new major line. Generated CI is now
+  advisory-first while the direct composite Action remains blocking by default;
+  suppression metrics changed from configured to matched findings, and
+  zero-finding output no longer implies a clean or green suite. Publishing
+  these changes as another `3.0.0` is prohibited.
+
+### Changed
+
+- **Advisory-first generated CI adoption** — `mjolnir ci install` now
+  defaults to non-blocking findings and non-blocking partial scans. The direct
+  composite Action remains blocking by default. Blocking behavior is explicit
+  through `--gate error`, `--gate warning`, or `fail-on`.
 - Suppression counts now report matched findings, not configured entries;
   `suppression-gate` evaluates all-tier pre-suppression findings and enforces
   total-count limits.
@@ -34,6 +620,44 @@ once shipped, so this file is the record of what changed between versions.
   before it ships; and `scripts/check-ci-local-parity.mjs`, which keeps
   `ci.yml`, `merge-verify.yml` and the local gate exercising the same
   command list. All additive — no frozen surface changed.
+- **M26–M50 execution ledger** — added `docs/ROADMAP.yaml`, dated GitHub
+  issue/milestone/PR reconciliation, explicit issue dispositions, an
+  append-only gap ledger, a finite support matrix, and an external-validation
+  record. Approval authority and staged dependency resolution are recorded;
+  external evidence remains `BLOCKED`/`NOT_RUN` and cannot be synthesized.
+- **Provisional capability contracts** — added bounded, non-promoting
+  contracts for runtime evidence, provider capabilities, QA domain records,
+  agent decision receipts, plugin packs, change intelligence, mutation
+  sensitivity, adversarial challenges, simulation, language/framework packs,
+  cross-repository systems, history, detector lifecycle, research, benchmark,
+  scale, UX parity, and Trust OS release proofs. Each has focused hostile,
+  stale, foreign, malformed, and recovery coverage.
+- **Release control surfaces** — added exact version-surface synchronization,
+  RC-aware changelog validation, candidate manifest refresh/readiness,
+  reporter ramp policy, fail-closed M26 audit gates, and current-major-only
+  Action tag maintenance.
+- **README release preparation** — canonical and translated README install
+  references, release-status blocks, and new command rows are synchronized to
+  `3.0.0`; English fallback blocks are explicitly marked for human translation
+  review, and the canonical README states the certification boundary.
+- **Release proof hardening** — stable publication now generates and attaches
+  an SPDX SBOM, rejects same-version registry artifacts with a different
+  integrity digest, updates only the current `v3` Action major, and never
+  clobbers release assets.
+- **Support matrix reconciliation** — 136 cells are classified as 90 tested,
+  44 explicitly blocked, and 2 not applicable, with evidence paths and revisit
+  triggers checked locally.
+
+### Fixed
+
+- Corpus runs now record complete rule-crash provenance, reject parser
+  fallbacks, and support a provenance-only refresh that cannot update counts.
+- QA-PY-004 sanitizes assertion roots before constructing a pattern, removing
+  corpus crashes caused by nested call-like targets.
+- Pathological stress runs no longer mask crashes with `|| true`; soak evidence
+  no longer claims parent-process RSS as child memory.
+- Exact registry-install smoke can install and verify a published version
+  instead of substituting the checkout tarball.
 
 ## [3.0.0] — 2026-09-24
 
@@ -286,8 +910,6 @@ Complete implementation of the Mjolnir Master Engineering Roadmap & Product Spec
 - `src/commands/doctor.ts` gains check 11 (rule metadata contract validation).
 - 4 fingerprint implementations consolidated into `src/engine/finding-identity.ts`.
 
-## [Unreleased] — Nordic brand pass
-
 ### Changed
 
 - Terminal report: section headers are marked `▍ TITLE` instead of