mjolnir-qa 3.0.0 → 5.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (31) hide show
  1. package/CHANGELOG.md +628 -6
  2. package/README.ar.md +58 -29
  3. package/README.bn.md +58 -29
  4. package/README.br.md +58 -29
  5. package/README.bs.md +58 -29
  6. package/README.da.md +59 -30
  7. package/README.de.md +59 -30
  8. package/README.es.md +58 -29
  9. package/README.fr.md +59 -30
  10. package/README.gr.md +58 -29
  11. package/README.he.md +58 -29
  12. package/README.it.md +58 -29
  13. package/README.ja.md +58 -29
  14. package/README.ko.md +58 -29
  15. package/README.md +95 -56
  16. package/README.no.md +58 -29
  17. package/README.pl.md +58 -29
  18. package/README.ru.md +58 -29
  19. package/README.th.md +58 -29
  20. package/README.tr.md +58 -29
  21. package/README.uk.md +58 -29
  22. package/README.vi.md +58 -29
  23. package/README.zh.md +58 -29
  24. package/README.zht.md +58 -29
  25. package/dist/cli.d.mts +398 -17
  26. package/dist/cli.mjs +2893 -1005
  27. package/dist/mcp/stdio.mjs +1576 -715
  28. package/dist/scan-pipeline-DNYbnWjE.mjs +2 -0
  29. package/dist/{scan-pipeline-CAH9_Qgh.mjs → scan-pipeline-DT8DWAMl.mjs} +1777 -978
  30. package/package.json +70 -9
  31. package/dist/scan-pipeline-CRe7-MQn.mjs +0 -2
package/README.ko.md CHANGED
@@ -18,7 +18,7 @@ Mjölnir는 실패할 수 없는 테스트와 빨간색이 될 수 없는 파이
18
18
  [![node](https://img.shields.io/badge/node-%E2%89%A5%2022.18-1F6F7C.svg?style=flat-square&labelColor=0A1119)](https://nodejs.org)
19
19
 
20
20
  ```bash
21
- npx mjolnir-qa@latest
21
+ npx mjolnir-qa@3.0.0
22
22
  ```
23
23
 
24
24
  [실제 동작 보기](#실제-동작-보기) · [빠른 시작](#빠른-시작) · [무엇을 찾는가](#mjölnir가-찾는-것) · [점수](#신뢰도-점수) · [증거](#증거-모델) · [실행 포렌식](#런타임-포렌식) · [CI](#ci-무결성) · [에이전트](#ai-에이전트) · [보안](#신뢰와-보안) · [한계](#mjölnir가-알려줄-수-없는-것) · [문서](#문서)
@@ -28,9 +28,9 @@ npx mjolnir-qa@latest
28
28
 
29
29
  [English](README.md) | [简体中文](README.zh.md) | [繁體中文](README.zht.md) | 한국어 | [Deutsch](README.de.md) | [Español](README.es.md) | [Français](README.fr.md) | [Italiano](README.it.md) | [Dansk](README.da.md) | [日本語](README.ja.md) | [Polski](README.pl.md) | [Русский](README.ru.md) | [Norsk](README.no.md) | [Português (Brasil)](README.br.md) | [ไทย](README.th.md) | [Türkçe](README.tr.md) | [Українська](README.uk.md) | [বাংলা](README.bn.md) | [Ελληνικά](README.gr.md) | [Tiếng Việt](README.vi.md) | [עברית](README.he.md) | [العربية](README.ar.md) | [Bosanski](README.bs.md)
30
30
 
31
- > 🤖 Machine-assisted translation. The [English README](README.md) is canonical. Last synced: 2026-09-15.
31
+ > 🤖 Machine-assisted translation. The [English README](README.md) is canonical. Last synced: 2026-09-26.
32
32
 
33
- <!-- Source hash: 3541b09e8d04 -->
33
+ <!-- Source hash: `de04dfb1677b` -->
34
34
 
35
35
  </details>
36
36
 
@@ -38,6 +38,20 @@ npx mjolnir-qa@latest
38
38
 
39
39
  <br />
40
40
 
41
+ ## Release status (English canonical)
42
+
43
+ The published line is `3.0.0`; this working tree is the `4.0.0-rc.1`
44
+ candidate. `3.0.0` must not be republished or retagged. The M26–M50 program is
45
+ tracked in
46
+ [`docs/ROADMAP.yaml`](docs/ROADMAP.yaml); provisional capability contracts
47
+ are not automatically enabled or certified. Repository-owned checks pass, but
48
+ Trust certification remains `NOT_CERTIFIED` until the protected holdout,
49
+ real-world, platform/consumer, remote-workflow, support-matrix, and corpus
50
+ evidence gates pass. Run `npm run m26:readiness` before treating any candidate
51
+ as releasable. This document does not publish a tag or authorize a release.
52
+
53
+ > Machine-assisted canonical text. Translate this block before treating it as localized copy.
54
+
41
55
  ## 초록색 체크는 주장일 뿐, 증명이 아닙니다
42
56
 
43
57
  초록색 체크는 파이프라인이 실패하지 않았다는 뜻입니다. 테스트가 실행되었다거나, 테스트가 실패할 수 있었다는 뜻은 아닙니다. 다음은 모두 초록색으로 통과합니다.
@@ -58,7 +72,7 @@ npx mjolnir-qa@latest
58
72
 
59
73
  <sub>데모 스캔이 이 workflow에 대해 보고한 모든 발견 사항을 보고된 줄에 표시했습니다. `npm run docs:readme-brand`가 [`demo-report.json`](assets/readme/demo-report.json)에서 생성하며, CI에서 변경되지 않도록 고정됩니다.</sub>
60
74
 
61
- **엄격 모드.** 가장 공격적인 탐지 — `.only`, `continue-on-error`, 빈 테스트, 재시도 남용 — 는 격리 티어에 있습니다. `--strict`에서만 실행되며 `info` 심각도로 제한됩니다: 플래그를 지정하지만 절대 게이트를 닫지 않습니다. 기본 스캔(`--strict` 없는 `npx mjolnir-qa@latest`)은 핵심 및 확장 규칙만 다룹니다. 자문 레이어도 원할 때 `--strict`를 추가하세요.
75
+ **엄격 모드.** 가장 공격적인 탐지 — `.only`, `continue-on-error`, 빈 테스트, 재시도 남용 — 는 격리 티어에 있습니다. `--strict`에서만 실행되며 `info` 심각도로 제한됩니다: 플래그를 지정하지만 절대 게이트를 닫지 않습니다. 기본 스캔(`--strict` 없는 `npx mjolnir-qa@3.0.0`)은 핵심 및 확장 규칙만 다룹니다. 자문 레이어도 원할 때 `--strict`를 추가하세요.
62
76
 
63
77
  Mjölnir는 테스트 스위트와 CI workflow, 그리고 있다면 실제 실행 리포트를 읽습니다. 테스트를 실행하지 않고, 의존성을 설치하지 않으며, 스캔하는 코드를 실행하지도 않습니다. 증거가 없을 때는 확신을 지어내는 대신 그렇다고 말합니다.
64
78
 
@@ -93,7 +107,7 @@ CI workflow가 있는 작은 Playwright 스위트인 [`examples/demo-repo`](exam
93
107
 
94
108
  <p align="center">
95
109
  <a href="assets/video/mjolnir-demo.mp4">
96
- <img src="assets/video/mjolnir-demo-poster.png" alt="데모 녹화의 한 프레임: 터미널 창에서 npx mjolnir-qa@latest가 데모 저장소를 스캔하는 모습" width="900" />
110
+ <img src="assets/video/mjolnir-demo-poster.png" alt="데모 녹화의 한 프레임: 터미널 창에서 npx mjolnir-qa@3.0.0가 데모 저장소를 스캔하는 모습" width="900" />
97
111
  </a>
98
112
  </p>
99
113
 
@@ -162,7 +176,7 @@ Docs: mjolnir rules --md (full catalog, this rule included)
162
176
  ## 빠른 시작
163
177
 
164
178
  ```bash
165
- npx mjolnir-qa@latest
179
+ npx mjolnir-qa@3.0.0
166
180
  ```
167
181
 
168
182
  현재 디렉터리를 스캔하고 Trust Report를 출력합니다. 무엇을 찾았는지, 어디까지 믿을 수 있는지, 그 이유, 그리고 다음에 할 일. 게이트 이상에서 아무것도 발견되지 않으면 `0`으로 종료합니다.
@@ -170,24 +184,39 @@ npx mjolnir-qa@latest
170
184
  CI에서는 브랜치가 도입한 부분만 스캔하세요. 그래야 레거시 스위트가 첫 pull request를 뒤덮지 않습니다.
171
185
 
172
186
  ```bash
173
- npx mjolnir-qa@latest --scope changed
187
+ npx mjolnir-qa@3.0.0 --scope changed
174
188
  ```
175
189
 
176
- `mjolnir ci install`은 이를 GitHub Actions workflow로 작성하며, 메이저 태그 `v1`에 고정된 [action](https://github.com/Sergey-Bar/Mjolnir#readme)을 사용합니다 (`--no-action`을 쓰면 일반 `npx`). 차단해야 한다고 결정하기 전까지는 권고 모드로 유지됩니다.
177
-
178
- | 명령 | 하는 일 |
179
- | ----------------------------------- | ----------------------------------------------- |
180
- | `mjolnir` | Trust Report: 판정, 확신도, 다음 조치 |
181
- | `mjolnir --scope changed` | 브랜치가 도입한 부분만 (CI용 형태) |
182
- | `mjolnir ci install` | 권고용 PR workflow 생성 (action 기반) |
183
- | `mjolnir explain QA-CI-001` | 무엇이, 왜, 어떻게 고치는지와 측정된 FP 비율 |
184
- | `mjolnir why src/a.spec.ts:42` | 바로 이 줄이 표시된 이유. 차단하지 않습니다. |
185
- | `mjolnir forensics ./test-results/` | 실제 실행에서 얻은 런타임 증거 |
186
- | `mjolnir trust-report` | 독립형 Trust Artifact (md + json) |
187
- | `mjolnir handoff` | 코딩 에이전트를 위한 수정 계획 |
188
- | `mjolnir --json` / `--format sarif` | 기계가 읽을 수 있는 출력, GitHub Code Scanning |
189
- | `mjolnir --format codequality` | GitLab Code Quality 리포트 (MR 위젯 아티팩트) |
190
- | `mjolnir --strict` | quarantine 등급 규칙도 실행 (FP 위험이 더 높음) |
190
+ `mjolnir ci install`은 이를 GitHub Actions workflow로 작성하며, 메이저 태그 `v3`에 고정된 [action](https://github.com/Sergey-Bar/Mjolnir#readme)을 사용합니다 (`--no-action`을 쓰면 일반 `npx`). 차단해야 한다고 결정하기 전까지는 권고 모드로 유지됩니다.
191
+
192
+ | 명령 | 하는 일 |
193
+ | --------------------------------------------- | ----------------------------------------------- |
194
+ | `mjolnir` | Trust Report: 판정, 확신도, 다음 조치 |
195
+ | `mjolnir --scope changed` | 브랜치가 도입한 부분만 (CI용 형태) |
196
+ | `mjolnir ci install` | 권고용 PR workflow 생성 (action 기반) |
197
+ | `mjolnir business-case` | ROI estimate: projected savings per finding |
198
+ | `mjolnir release-report` | Release readiness: GO, CONDITIONAL GO, or NO-GO |
199
+ | `mjolnir release-trust` | 12-dimension release assurance verdict |
200
+ | `mjolnir report` | Generate a Playwright-compatible report |
201
+ | `mjolnir trend` | Record, show, or diff local quality snapshots |
202
+ | `mjolnir policy` | Initialize, validate, or check policy gates |
203
+ | `mjolnir quarantine` | Review deterministic proposals (prototype) |
204
+ | `mjolnir analyze --cross-file` | Bounded cross-file analysis |
205
+ | `mjolnir ci-adapter github .` | Generate CI templates for supported providers |
206
+ | `mjolnir dashboard` | Generate a self-contained quality dashboard |
207
+ | `mjolnir exec-report` | Executive KPIs and recommendations (advisory) |
208
+ | `mjolnir enterprise` | Self-hosted templates (prototype) |
209
+ | `mjolnir maturity` | Assess maturity or display maturity levels |
210
+ | `mjolnir mutation tests/mutation-report.json` | Analyze mutation reports; never promotes trust |
211
+ | `mjolnir mcp` | Read-only MCP tools over stdio |
212
+ | `mjolnir explain QA-CI-001` | 무엇이, 왜, 어떻게 고치는지와 측정된 FP 비율 |
213
+ | `mjolnir why src/a.spec.ts:42` | 바로 이 줄이 표시된 이유. 차단하지 않습니다. |
214
+ | `mjolnir forensics ./test-results/` | 실제 실행에서 얻은 런타임 증거 |
215
+ | `mjolnir trust-report` | 독립형 Trust Artifact (md + json) |
216
+ | `mjolnir handoff` | 코딩 에이전트를 위한 수정 계획 |
217
+ | `mjolnir --json` / `--format sarif` | 기계가 읽을 수 있는 출력, GitHub Code Scanning |
218
+ | `mjolnir --format codequality` | GitLab Code Quality 리포트 (MR 위젯 아티팩트) |
219
+ | `mjolnir --strict` | quarantine 등급 규칙도 실행 (FP 위험이 더 높음) |
191
220
 
192
221
  <details>
193
222
  <summary><strong>그 밖의 모든 명령</strong> — 불안정한 테스트 분류, 리포트, 거버넌스</summary>
@@ -452,18 +481,18 @@ mjolnir ci install
452
481
  또는 이미 있는 workflow에 Marketplace action을 추가합니다:
453
482
 
454
483
  ```yaml
455
- - uses: Sergey-Bar/Mjolnir@v1
484
+ - uses: Sergey-Bar/Mjolnir@v3
456
485
  with:
457
486
  scope: changed
458
487
  fail-on: error
459
488
  ```
460
489
 
461
- 메이저 라인을 따라가려면 `@v1`을, 재현 가능한 게이트를 원하면 정확한 태그 (`@v0.5.32`)를 고정하세요. [docs/DISTRIBUTION-KIT.md](docs/DISTRIBUTION-KIT.md)는 Marketplace, Smithery, MCP 레지스트리를 다룹니다.
490
+ 메이저 라인을 따라가려면 `@v3`을, 재현 가능한 게이트를 원하면 정확한 태그 (`@v0.5.32`)를 고정하세요. [docs/DISTRIBUTION-KIT.md](docs/DISTRIBUTION-KIT.md)는 Marketplace, Smithery, MCP 레지스트리를 다룹니다.
462
491
 
463
492
  발견 사항을 GitHub Code Scanning에 올리려면 SARIF를 업로드하세요 (workflow 또는 job 범위에서 `security-events: write` 필요):
464
493
 
465
494
  ```yaml
466
- - run: npx mjolnir-qa@latest --format sarif > mjolnir.sarif
495
+ - run: npx mjolnir-qa@3.0.0 --format sarif > mjolnir.sarif
467
496
  continue-on-error: true
468
497
  - uses: github/codeql-action/upload-sarif@v3
469
498
  if: ${{ !cancelled() }}
@@ -476,7 +505,7 @@ GitLab에서는 `--format codequality`가 MR 위젯과 diff 주석이 읽는 Cod
476
505
  ### 변경 범위 귀속
477
506
 
478
507
  ```bash
479
- npx mjolnir-qa@latest --scope changed
508
+ npx mjolnir-qa@3.0.0 --scope changed
480
509
  ```
481
510
 
482
511
  발견 사항은 **merge-base** 기준으로 측정해 브랜치가 추가한 줄에 귀속됩니다. 범위는 전체 스캔이 찾는 것과 같은 파일 집합 (TS/JS spec과 어댑터 설정, `test_*.py`, `*Test.java`, `*Tests.cs`, `.github/workflows/*.yml`)에 커밋되지 않은 변경과 추적되지 않은 변경을 더한 것이라, 커밋하기 전에도 동작합니다. 기준은 `main → master → origin/main → origin/master → origin/HEAD` 순서로 결정되며, `--base <ref>`로 바꿀 수 있습니다.
@@ -504,7 +533,7 @@ SCAN → EVIDENCE → HANDOFF → AGENT → RE-SCAN → PROOF
504
533
  자체 CLI가 있는 클라이언트에 추가하기:
505
534
 
506
535
  ```bash
507
- claude mcp add mjolnir -- npx -y mjolnir-qa@latest mcp
536
+ claude mcp add mjolnir -- npx -y mjolnir-qa@3.0.0 mcp
508
537
  ```
509
538
 
510
539
  또는 `mcpServers` 블록을 받는 모든 클라이언트에:
@@ -512,7 +541,7 @@ claude mcp add mjolnir -- npx -y mjolnir-qa@latest mcp
512
541
  ```json
513
542
  {
514
543
  "mcpServers": {
515
- "mjolnir": { "command": "npx", "args": ["-y", "mjolnir-qa@latest", "mcp"] }
544
+ "mjolnir": { "command": "npx", "args": ["-y", "mjolnir-qa@3.0.0", "mcp"] }
516
545
  }
517
546
  }
518
547
  ```
@@ -603,7 +632,7 @@ mjolnir create-rule QA-PW-140 --title "Screenshot without diff bound"
603
632
  <img src="assets/readme/closing.svg" alt="여러분의 저장소에서 실행해 보세요." width="100%" />
604
633
 
605
634
  ```bash
606
- npx mjolnir-qa@latest
635
+ npx mjolnir-qa@3.0.0
607
636
  ```
608
637
 
609
638
  [가이드 읽기](https://sergey-bar.github.io/Mjolnir/guide/getting-started) · [문서 사이트](https://sergey-bar.github.io/Mjolnir/) · [npm](https://www.npmjs.com/package/mjolnir-qa)
package/README.md CHANGED
@@ -18,7 +18,7 @@ when verification isn't earning its keep.
18
18
  [![node](https://img.shields.io/badge/node-%E2%89%A5%2022.18-1F6F7C.svg?style=flat-square&labelColor=0A1119)](https://nodejs.org)
19
19
 
20
20
  ```bash
21
- npx mjolnir-qa@latest
21
+ npx mjolnir-qa@5.0.0
22
22
  ```
23
23
 
24
24
  [See it work](#see-it-work) · [Quickstart](#quickstart) · [What it finds](#what-mjölnir-finds) · [Score](#the-worthiness-score) · [Evidence](#the-evidence-model) · [Forensics](#runtime-forensics) · [CI](#ci-integrity) · [Agents](#ai-agents) · [Security](#trust-and-security) · [Limits](#what-mjölnir-cannot-tell-you) · [Docs](#documentation)
@@ -67,7 +67,7 @@ reported. Generated by `npm run docs:readme-brand` from
67
67
  **Strict mode.** The most aggressive detections — `.only`, `continue-on-error`,
68
68
  empty tests, retry abuse — live in the quarantine tier. They run only
69
69
  under `--strict` and are capped to `info` severity: they flag, they never
70
- gate. The default scan (`npx mjolnir-qa@latest` without `--strict`)
70
+ gate. The default scan (`npx mjolnir-qa@5.0.0` without `--strict`)
71
71
  covers core and extended rules only. Add `--strict` when you want the
72
72
  advisory layer too.
73
73
 
@@ -95,6 +95,18 @@ registry, never typed by hand. The same picture as a poster:
95
95
 
96
96
  <br />
97
97
 
98
+ ## Release status
99
+
100
+ The published line is `3.0.0`; this working tree is the `4.0.0-rc.1`
101
+ candidate. `3.0.0` must not be republished or retagged. The M26–M50 program is
102
+ tracked in
103
+ [`docs/ROADMAP.yaml`](docs/ROADMAP.yaml); provisional capability contracts
104
+ are not automatically enabled or certified. Repository-owned checks pass, but
105
+ Trust certification remains `NOT_CERTIFIED` until the protected holdout,
106
+ real-world, platform/consumer, remote-workflow, support-matrix, and corpus
107
+ evidence gates pass. Run `npm run m26:readiness` before treating any candidate
108
+ as releasable. This document does not publish a tag or authorize a release.
109
+
98
110
  ## See it work
99
111
 
100
112
  A real scan of [`examples/demo-repo`](examples/demo-repo), a small
@@ -115,7 +127,7 @@ CI. The full `--verbose` report of the same scan is
115
127
 
116
128
  <p align="center">
117
129
  <a href="assets/video/mjolnir-demo.mp4">
118
- <img src="assets/video/mjolnir-demo-poster.png" alt="A frame of the demo recording: npx mjolnir-qa@latest scanning the demo repository in a terminal window" width="900" />
130
+ <img src="assets/video/mjolnir-demo-poster.png" alt="A frame of the demo recording: npx mjolnir-qa@5.0.0 scanning the demo repository in a terminal window" width="900" />
119
131
  </a>
120
132
  </p>
121
133
 
@@ -199,13 +211,13 @@ That is the unit of value: one place where CI reports a pass it did not earn.
199
211
  ## Quickstart
200
212
 
201
213
  ```bash
202
- npx mjolnir-qa@latest
214
+ npx mjolnir-qa@5.0.0
203
215
  ```
204
216
 
205
217
  Three steps to trust your release pipeline:
206
218
 
207
- 1. **Scan** — `npx mjolnir-qa@latest` — scans the current directory, prints the Trust Report, exits `1` if findings at the gate
208
- 2. **Block in CI** — `npx mjolnir-qa@latest --scope changed` — scans only changed lines, blocks PRs with error findings
219
+ 1. **Scan** — `npx mjolnir-qa@5.0.0` — scans the current directory, prints the Trust Report, exits `1` if findings at the gate
220
+ 2. **Block in CI** — `npx mjolnir-qa@5.0.0 --scope changed` — scans only changed lines, blocks PRs with error findings
209
221
  3. **Fix and re-verify** — `mjolnir fix` applies safe auto-fixes, then re-scans to prove each one landed
210
222
 
211
223
  Install the advisory PR workflow first, so existing trust debt cannot break
@@ -221,22 +233,38 @@ After reviewing the findings or baselining existing debt, opt into blocking:
221
233
  mjolnir ci install --gate error
222
234
  ```
223
235
 
224
- | Command | What it does |
225
- | ----------------------------------- | ----------------------------------------------- |
226
- | `mjolnir` | Trust Report: verdict, confidence, next action |
227
- | `mjolnir --scope changed` | Only what your branch introduced (CI form) |
228
- | `mjolnir --blocking error` | Exit 1 on error findings — gate releases |
229
- | `mjolnir ci install` | Write the advisory PR workflow (default) |
230
- | `mjolnir ci install --gate error` | Opt into the blocking PR workflow |
231
- | `mjolnir business-case` | ROI estimate: projected savings per finding |
232
- | `mjolnir explain QA-CI-001` | What, why and fix, plus the measured FP rate |
233
- | `mjolnir why src/a.spec.ts:42` | Why this exact line was flagged. Never gates. |
234
- | `mjolnir forensics ./test-results/` | Runtime evidence from a real run |
235
- | `mjolnir trust-report` | Self-contained Trust Artifact (md + json) |
236
- | `mjolnir handoff` | Remediation plan for a coding agent |
237
- | `mjolnir --json` / `--format sarif` | Machine-readable output, GitHub Code Scanning |
238
- | `mjolnir --format codequality` | GitLab Code Quality report (MR widget artifact) |
239
- | `mjolnir --strict` | Also run quarantine-tier rules (higher FP risk) |
236
+ | Command | What it does |
237
+ | --------------------------------------------- | ------------------------------------------------------------ |
238
+ | `mjolnir` | Trust Report: verdict, confidence, next action |
239
+ | `mjolnir --scope changed` | Only what your branch introduced (CI form) |
240
+ | `mjolnir --blocking error` | Exit 1 on error findings — gate releases |
241
+ | `mjolnir ci install` | Write the advisory PR workflow (default) |
242
+ | `mjolnir ci install --gate error` | Opt into the blocking PR workflow |
243
+ | `mjolnir business-case` | Measured FP rates; a cost figure only with `--incident-cost` |
244
+ | `mjolnir release-report` | Release readiness: GO, CONDITIONAL GO, or NO-GO |
245
+ | `mjolnir release-trust` | 12-dimension release assurance verdict |
246
+ | `mjolnir report` | Findings in a Playwright-shaped file (no test outcomes) |
247
+ | `mjolnir diff` | What changed against the stored baseline, by fingerprint |
248
+ | `mjolnir verify` | Digest of what a change resolved and what it introduced |
249
+ | `mjolnir trend` | Record, show, or diff local quality snapshots |
250
+ | `mjolnir policy` | Initialize, validate, or check policy gates |
251
+ | `mjolnir quarantine` | Review deterministic proposals (prototype) |
252
+ | `mjolnir analyze --cross-file` | Bounded cross-file analysis |
253
+ | `mjolnir ci-adapter github .` | Generate CI templates for supported providers |
254
+ | `mjolnir dashboard` | Generate a self-contained quality dashboard |
255
+ | `mjolnir exec-report` | Executive KPIs and recommendations (advisory) |
256
+ | `mjolnir enterprise` | Self-hosted templates (prototype) |
257
+ | `mjolnir maturity` | Assess maturity or display maturity levels |
258
+ | `mjolnir mutation tests/mutation-report.json` | Analyze mutation reports; never promotes trust |
259
+ | `mjolnir mcp` | Read-only MCP tools over stdio |
260
+ | `mjolnir explain QA-CI-001` | What, why and fix, plus measured/unmeasured state |
261
+ | `mjolnir why src/a.spec.ts:42` | Why this exact line was flagged. Never gates. |
262
+ | `mjolnir forensics ./test-results/` | Runtime evidence from a real run |
263
+ | `mjolnir trust-report` | Self-contained Trust Artifact (md + json) |
264
+ | `mjolnir handoff` | Remediation plan for a coding agent |
265
+ | `mjolnir --json` / `--format sarif` | Machine-readable output, GitHub Code Scanning |
266
+ | `mjolnir --format codequality` | GitLab Code Quality report (MR widget artifact) |
267
+ | `mjolnir --strict` | Also run quarantine-tier rules (higher FP risk) |
240
268
 
241
269
  <details>
242
270
  <summary><strong>Every other command</strong> — flake triage, reporting, governance</summary>
@@ -508,17 +536,17 @@ Promotion, demotion and per-language maturity:
508
536
  Linters tell you whether code follows rules. Mjölnir tells you whether your
509
537
  verification can be trusted.
510
538
 
511
- | | Linters (ESLint, SonarQube) | Coverage tools | AI code review | **Mjölnir** |
512
- | -------------------------------------------------------- | :-------------------------: | :------------: | :------------: | :--------------: |
513
- | Scores the **verification system**, not the product code | No | No | No | Yes |
514
- | CI workflow integrity (`continue-on-error`, `\|\| true`) | No | No | only the diff | Yes |
515
- | Grades Playwright locator resilience (Selector Health) | No | No | No | Yes |
516
- | Reads real run data for `TRUE-FLAKE` verdicts | No | No | No | Yes |
517
- | Publishes a measured false-positive rate per rule | No | No | No | Yes |
518
- | Flags tests with no assertions | Yes\* | No | sometimes | Yes |
519
- | Catches hard sleeps (`waitForTimeout`, `time.sleep`) | Yes\* | No | sometimes | Yes |
520
- | Deterministic (same input, same output) | Yes | Yes | No | Yes |
521
- | Cost per scan | free | free | tokens | **zero** (local) |
539
+ | | Linters (ESLint, SonarQube) | Coverage tools | AI code review | **Mjölnir** |
540
+ | -------------------------------------------------------------------- | :-------------------------: | :------------: | :------------: | :--------------: |
541
+ | Scores the **verification system**, not the product code | No | No | No | Yes |
542
+ | CI workflow integrity (`continue-on-error`, `\|\| true`) | No | No | only the diff | Yes |
543
+ | Grades Playwright locator resilience (Selector Health) | No | No | No | Yes |
544
+ | Reads real run data for `TRUE-FLAKE` verdicts | No | No | No | Yes |
545
+ | Publishes measured false-positive rates where corpus evidence exists | No | No | No | Yes |
546
+ | Flags tests with no assertions | Yes\* | No | sometimes | Yes |
547
+ | Catches hard sleeps (`waitForTimeout`, `time.sleep`) | Yes\* | No | sometimes | Yes |
548
+ | Deterministic (same input, same output) | Yes | Yes | No | Yes |
549
+ | Cost per scan | free | free | tokens | **zero** (local) |
522
550
 
523
551
  <sub>\*Covered by `eslint-plugin-jest` and `eslint-plugin-playwright`
524
552
  (`expect-expect`, `no-wait-for-timeout`) and by SonarQube's own assertion
@@ -577,6 +605,10 @@ and is pinned to this version, so adopting it cannot change gate semantics:
577
605
  mjolnir ci install
578
606
  ```
579
607
 
608
+ The generated workflow is advisory by default. A direct
609
+ `uses: Sergey-Bar/Mjolnir@...` composite Action is blocking by default; set
610
+ `fail-on` explicitly when its policy differs.
611
+
580
612
  After reviewing existing debt, opt into an enforcing gate:
581
613
 
582
614
  ```bash
@@ -595,14 +627,14 @@ In your existing workflow, pin the action and explicitly opt into an error gate:
595
627
  The `--blocking error` flag does the same in any CI pipeline:
596
628
 
597
629
  ```bash
598
- npx mjolnir-qa@latest --scope changed --blocking error
630
+ npx mjolnir-qa@5.0.0 --scope changed --blocking error
599
631
  ```
600
632
 
601
633
  To put findings in GitHub Code Scanning, upload SARIF (requires
602
634
  `security-events: write` at workflow or job scope):
603
635
 
604
636
  ```yaml
605
- - run: npx mjolnir-qa@latest --format sarif > mjolnir.sarif
637
+ - run: npx mjolnir-qa@5.0.0 --format sarif > mjolnir.sarif
606
638
  continue-on-error: true
607
639
  - uses: github/codeql-action/upload-sarif@v3
608
640
  if: ${{ !cancelled() }}
@@ -617,7 +649,7 @@ Editor and pipeline setup: [docs/SARIF-INTEGRATION.md](docs/SARIF-INTEGRATION.md
617
649
  ### Changed-scope attribution
618
650
 
619
651
  ```bash
620
- npx mjolnir-qa@latest --scope changed
652
+ npx mjolnir-qa@5.0.0 --scope changed
621
653
  ```
622
654
 
623
655
  Findings are attributed to the lines your branch added, measured against
@@ -655,7 +687,7 @@ re-scan, never from the agent's own report of success.
655
687
  Add it to a client that ships its own CLI:
656
688
 
657
689
  ```bash
658
- claude mcp add mjolnir -- npx -y mjolnir-qa@latest mcp
690
+ claude mcp add mjolnir -- npx -y mjolnir-qa@5.0.0 mcp
659
691
  ```
660
692
 
661
693
  Or to any client that takes an `mcpServers` block:
@@ -663,7 +695,10 @@ Or to any client that takes an `mcpServers` block:
663
695
  ```json
664
696
  {
665
697
  "mcpServers": {
666
- "mjolnir": { "command": "npx", "args": ["-y", "mjolnir-qa@latest", "mcp"] }
698
+ "mjolnir": {
699
+ "command": "npx",
700
+ "args": ["-y", "mjolnir-qa@5.0.0", "mcp"]
701
+ }
667
702
  }
668
703
  }
669
704
  ```
@@ -753,26 +788,30 @@ Rule IDs (`QA-<FAMILY>-NNN`) are immutable once shipped and never reused.
753
788
 
754
789
  The full docs site is at <https://sergey-bar.github.io/Mjolnir/>.
755
790
 
756
- | Document | What's in it |
757
- | ------------------------------------------------------ | ------------------------------------------------- |
758
- | [docs/EXECUTIVE-ROI.md](docs/EXECUTIVE-ROI.md) | Business case for decision-makers |
759
- | [docs/SCORING.md](docs/SCORING.md) | Score normalization and evidence weighting |
760
- | [docs/TERMINOLOGY.md](docs/TERMINOLOGY.md) | Canonical vocabulary: one word per concept |
761
- | [docs/FP-AUDIT.md](docs/FP-AUDIT.md) | Measured false-positive rates and the method |
762
- | [docs/RULE-LIFECYCLE.md](docs/RULE-LIFECYCLE.md) | Rule states, tiers, suppression, deprecation |
763
- | [docs/VERSIONING.md](docs/VERSIONING.md) | Semver policy, frozen surfaces, deprecation cycle |
764
- | [docs/machine-contract.md](docs/machine-contract.md) | The canonical machine-readable result |
765
- | [docs/SARIF-INTEGRATION.md](docs/SARIF-INTEGRATION.md) | SARIF output and editor or CI setup |
766
- | [docs/GITLAB-CI.md](docs/GITLAB-CI.md) | GitLab: Code Quality report, MR recipe, gate |
767
- | [docs/rules/](docs/rules/) | Generated per-rule catalog |
768
- | [CONTRIBUTING.md](CONTRIBUTING.md) | Dev setup and contribution workflow |
769
- | [SUPPORT.md](SUPPORT.md) | Where to ask, report and get help |
770
- | [SECURITY.md](SECURITY.md) | Vulnerability reporting |
771
- | [CHANGELOG.md](CHANGELOG.md) | Release history |
791
+ | Document | What's in it |
792
+ | ------------------------------------------------------------------ | --------------------------------------------------------- |
793
+ | [docs/EXECUTIVE-ROI.md](docs/EXECUTIVE-ROI.md) | Business case for decision-makers |
794
+ | [docs/SCORING.md](docs/SCORING.md) | Score normalization and evidence weighting |
795
+ | [docs/TERMINOLOGY.md](docs/TERMINOLOGY.md) | Canonical vocabulary: one word per concept |
796
+ | [docs/FP-AUDIT.md](docs/FP-AUDIT.md) | Measured false-positive rates and the method |
797
+ | [docs/RULE-LIFECYCLE.md](docs/RULE-LIFECYCLE.md) | Rule states, tiers, suppression, deprecation |
798
+ | [docs/VERSIONING.md](docs/VERSIONING.md) | Semver policy, frozen surfaces, deprecation cycle |
799
+ | [docs/machine-contract.md](docs/machine-contract.md) | The canonical machine-readable result |
800
+ | [docs/SARIF-INTEGRATION.md](docs/SARIF-INTEGRATION.md) | SARIF output and editor or CI setup |
801
+ | [docs/GITLAB-CI.md](docs/GITLAB-CI.md) | GitLab: Code Quality report, MR recipe, gate |
802
+ | [docs/rules/](docs/rules/) | Generated per-rule catalog |
803
+ | [CONTRIBUTING.md](CONTRIBUTING.md) | Dev setup and contribution workflow |
804
+ | [SUPPORT.md](SUPPORT.md) | Where to ask, report and get help |
805
+ | [SECURITY.md](SECURITY.md) | Vulnerability reporting |
806
+ | [docs/MIGRATION-3.0.0.md](docs/MIGRATION-3.0.0.md) | 3.0.0 migration checklist |
807
+ | [docs/INSTALLATION-3.0.0.md](docs/INSTALLATION-3.0.0.md) | Reproducible CLI, Action, and MCP installation |
808
+ | [docs/ROLLBACK-3.0.0.md](docs/ROLLBACK-3.0.0.md) | Rollback and corrective-release procedure |
809
+ | [docs/RELEASE-3.0.0-READINESS.md](docs/RELEASE-3.0.0-READINESS.md) | 3.0.0 release gates, migration, QA, and rollout checklist |
810
+ | [CHANGELOG.md](CHANGELOG.md) | Release history |
772
811
 
773
812
  ### Status
774
813
 
775
- **Version 1.** The JSON schema and the exit codes are frozen contracts.
814
+ **Version 3.0.0.** The JSON schema and the exit codes are frozen contracts.
776
815
  TypeScript and Python have the broadest measured coverage. Java and C# are
777
816
  newer; read them through the
778
817
  [maturity table](https://sergey-bar.github.io/Mjolnir/reference/rule-lifecycle).
@@ -800,7 +839,7 @@ fixture-firewall laws are in [CONTRIBUTING.md](CONTRIBUTING.md).
800
839
  <img src="assets/readme/closing.svg" alt="Run it on your repo." width="100%" />
801
840
 
802
841
  ```bash
803
- npx mjolnir-qa@latest
842
+ npx mjolnir-qa@5.0.0
804
843
  ```
805
844
 
806
845
  [Read the guide](https://sergey-bar.github.io/Mjolnir/guide/getting-started) · [Docs site](https://sergey-bar.github.io/Mjolnir/) · [npm](https://www.npmjs.com/package/mjolnir-qa)