mjolnir-qa 4.0.0 → 5.0.0

package/CHANGELOG.md

@@ -11,6 +11,8 @@ once shipped, so this file is the record of what changed between versions.
 
 ## [Unreleased]
 
+## [5.0.0] — 2026-09-27
+
 ### Breaking changes
 
 - **`business-case` no longer prints a dollar figure you did not supply.** The
@@ -47,6 +49,18 @@ once shipped, so this file is the record of what changed between versions.
   The generation timestamp moved out of the visible body into
   `<meta name="mjolnir-generated-at">`, and `--deterministic` omits it entirely
   so the artifact is byte-identical and can be diffed in review.
+- **`mjolnir report` no longer publishes a test-run status.** The top-level
+  `status` was computed from the findings
+  (`partial ? "interrupted" : hasError ? "failed" : "passed"`), so a clean scan
+  wrote `{status: "passed", totalTests: 0}` — the first field a Playwright
+  consumer reads, asserting a green run over zero executed tests, with the
+  contradicting `execution: "STATIC_ANALYSIS"` marker buried in the extension
+  block. `failed` was equally dishonest: it implies tests ran and lost. The
+  field is now the literal `interrupted` on every path, and what the scan
+  actually found is reported separately as
+  `mjolnir.scanOutcome` (`clean` / `blocked` / `partial`), which the previous
+  `mjolnir.status` field carried. Consumers reading the root `status` will see
+  `passed` → `interrupted`; that is the correction, not a regression.
 - **Score bands are decided in one place.** The dashboard split at 60 while the
   terminal split at 80, so a score the terminal called UNWORTHY rendered amber
   in HTML; the contributor handover used 90; `mermaid.ts` and
@@ -55,6 +69,14 @@ once shipped, so this file is the record of what changed between versions.
 
 ### Added
 
+- **`npm run ci:standard` now runs in CI.** `scripts/check-ci-standard.mjs`
+  was unit-tested by `tests/integrations/ci-standard.spec.ts` but referenced
+  by no workflow, so the invariants it checks — the PR scan's partial-analysis
+  handling, the coverage and ratchet gates, and the read-only scan job's
+  permissions — were enforced nowhere. It runs as a step in `workflow-lint`,
+  next to actionlint, since both are static checks of the repo's own CI
+  config.
+
 - **Opt-in Sentry crash reporting.** Set `SENTRY_DSN` and the CLI and the MCP
   stdio server report their own fatal errors — release-tagged as
   `mjolnir-qa@<version>`, tagged by surface, and nothing else: no user data
@@ -67,7 +89,11 @@ once shipped, so this file is the record of what changed between versions.
   the two existing top-level catch blocks rather than `uncaughtException` /
   `unhandledRejection` handlers, which would have changed the frozen exit-code
   contract. `npm run sentry:release` creates the release and uploads source maps
-  (the build now emits them; the published tarball still excludes them).
+  (the build now emits them; the published tarball still excludes them). Both
+  release pipelines now run it after `npm run build` and before `npm pack`,
+  because the debug ids it stamps are written into `dist/` in place: pack first
+  and the shipped tarball carries no ids, so the maps uploaded for the release
+  match nothing and every stack trace degrades to a bundle frame.
 - `npm run report:honesty` — no surface may print a zero for a measurement that
   may be absent. Four reviewed exceptions are recorded for computation inputs,
   each with a reason and a follow-up.
@@ -93,8 +119,229 @@ once shipped, so this file is the record of what changed between versions.
   or descriptor to print. It opens no file, touches no clock and formats no
   document, and a test enforces that.
 
+### Changed
+
+- **Ruleset `01` now enforces 11 required checks instead of 4.** It required
+  only the four `build-test` matrix contexts, which meant the repo's entire
+  review surface — self-scan, certification, generated-docs-drift, site-build,
+  workflow-lint, property, fuzz — could be red while a PR still merged. That
+  made every one of those checks advice rather than a gate, and it meant the
+  deleted `merge-verify.yml` header was describing a ruleset that never
+  existed. The enforced set is now the four matrix entries plus
+  `property-tests`, `fuzz`, `site-build`, `workflow-lint`, `self-scan`,
+  `certification` and `generated-docs-drift` — every check that can actually
+  block. Deliberately still _not_ required: `detector-revision-diff` (advisory
+  by design — a hard fail would only manufacture routine revision bumps),
+  `scan` / `publish` (the Mjölnir PR report, which reviewers read but which
+  duplicates `self-scan` on the `src` tree), and the CodeQL/OSV workflows,
+  which report but do not gate. `strict_required_status_checks_policy` and
+  `do_not_enforce_on_create` are preserved, so a PR must still be current with
+  `main` to merge.
+- **`docs/BRANCH-PROTECTION.md` now states the enforced set instead of an
+  aspiration.** It listed eight required checks; three of them were enforced.
+  Its verification command also read `branches/main/protection`, which does not
+  carry required checks at all on this repo — they live in ruleset `01` — so it
+  could not have worked. Both are corrected.
+
+### Removed
+
+- **The Snyk webhook is gone.** Snyk posted a `security/snyk (sergey-bar)`
+  commit status on every push, duplicating the first-party `osv-scanner.yml`
+  (`scan-pr` / `scan-scheduled`) and the Dependabot security updates that are
+  already configured. Repo webhooks are now empty. Restore with Snyk's own
+  integration settings if it is ever wanted back — the deleted hook pointed at
+  `https://api.snyk.io/webhook/github/4ac3f376-3f24-42f7-a2c4-8830700f671d`.
+- **The `merge-verify` workflow is gone.** It re-ran the entire PR gate
+  (build, typecheck, lint, coverage, property, fuzz, site, self-scan, docs
+  regen) on every push to `main` — roughly doubling CI cost. Its stated
+  justification was that "a green PR that merges into a red main is not a
+  green PR", but that failure class is already closed by ruleset `01` running
+  `strict_required_status_checks_policy`, which refuses to merge a PR that is
+  not current with `main`. The file also asserted that ruleset `01` "requires
+  the complete PR matrix, property/fuzz, site, workflow-lint, self-scan,
+  certification, detector-revision, and generated-docs checks before merge" —
+  it did not, and never has. The ruleset requires only the four `build-test`
+  matrix contexts. Both the workflow and the claim are removed rather than left
+  to mislead a reviewer about what blocks a merge.
+- **The `bench-advisory` CI job is gone.** It spent a full `npm ci` plus a
+  3 000-file benchmark run on every PR to produce a comparison that
+  `continue-on-error: true` then discarded, and whose only output was a
+  warning nobody could gate on. `npm run bench:scan`, the pinned
+  `.mjolnir/bench-baseline.json`, and their schema/comparison tests in
+  `tests/adversarial/bench-gate.spec.ts` are untouched — the benchmark is
+  still runnable and still tested, it just no longer costs every PR a runner.
+- **Four copies of the soft job time-budget report.** Each of `build-test`,
+  `self-scan`, `generated-docs-drift` and `bench-advisory` re-derived its own
+  wall-clock minutes into `$GITHUB_STEP_SUMMARY` and printed a warning that,
+  by its own comment, "never gates". The jobs already declare
+  `timeout-minutes`, which is the hard bound, and GitHub reports job duration
+  natively.
+
 ### Fixed
 
+- **Order in the report no longer depends on the machine that produced it.** 23
+  sites in `src/` sorted with a bare `localeCompare`, which resolves against the
+  process's default locale. `scan-cache.ts` was the worst: it sorted INSIDE
+  `hashDir`, so the order was fed to `hash.update(entry.name)` and became a
+  semantic input to the detector fingerprint that `isIncrementalSafe` keys off
+  — one repository, two fingerprints, one per locale. All 23 now use
+  `compareCodePoints` from `src/lib/compare.ts`, except two whose key is a
+  human-readable label, which use a comparator pinned to `en` rather than
+  inheriting the environment. `tests/contract/deterministic-ordering.spec.ts`
+  fails the build on any unpinned `localeCompare` in `src/`.
+- **`mjolnir bind` can no longer be hijacked by a repository's own `git`.**
+  `src/engine/candidate-binding.ts` — called on every scan — ran
+  `execFileSync("git", …)` with a bare name. On Windows `CreateProcess` searches
+  the current directory before `PATH`, so a committed `git.exe` in an untrusted
+  repo chose the `commit` and `tree` that land in `runIdentity` and the evidence
+  graph. It is the last bare-name process launch left in `src/`, and
+  `tests/contract/no-bare-process-exec.spec.ts` now audits the whole tree.
+- **The coverage exemption ledger can no longer drift silently.** Each
+  non-structural entry in `docs/COVERAGE-EXEMPTIONS.json` now carries
+  `defectSignatures` — regexes that must still match its file — or an explicit
+  `closureState` when the defect it described is gone. A signature that stops
+  matching fails the gate, so a code fix forces a ledger edit in the same
+  commit. Six entries were already describing defects the current code had
+  fixed (`maturity`, `business-case`, `dashboard`, `enterprise`, `exec-report`
+  and the `report-playwright` row), and are reclassified accordingly.
+- **Skipped and expected-fail tests now have a price.** Nothing in the
+  repository counted them, so the count could grow from zero to hundreds with
+  every other signal still green. `docs/SKIP-BUDGET.json` records the current
+  counts — 8 skipped tests, 1 skipped file, 3 expected failures — measured by
+  `scripts/vitest-skip-budget-reporter.mjs` during the run. They may fall;
+  raising them fails `npm run skip:budget` and names the tests that spent the
+  budget. A missing or incomplete measurement fails too, so a reporter that
+  stops being wired in cannot read as a clean run.
+- **The M26 release gate and the version-drift checks are covered where it
+  matters.** Both run inside `certify` and both were excluded from the coverage
+  ratchet, so their reject arms — the paths that only execute when something is
+  wrong — had no reviewer pressure on them. `tests/ledger/m26-validator-reject-arms.spec.ts`
+  is table-driven over every required field, so a field that is added without a
+  test fails; `tests/release/version-surface-drift-arms.spec.ts` covers the
+  fail-fast arms of the version synchronizer.
+- **One error derivation, one `isRecord`, one crash-isolation path.** The tree
+  carried `isRecord` eight times (seven byte-identical), error rendering four
+  times under two names, and crash isolation seven times — and the copies
+  disagreed, which is the only reason any of this mattered. `String(obj)`
+  renders `[object Object]`, so the two _thinner_ error helpers turned a real
+  Node failure shape like `throw { code: "EISDIR" }` into a message naming
+  nothing — in a doctor detail, an MCP tool result and a `summary` line
+  respectively. The richer body survived the collapse, and
+  `isRecord` — the predicate every JSON reader uses to decide "this is an
+  object I may index into", which is a question a hostile saved report gets
+  to ask — is now the exported one in `src/lib/safe-json.ts`. The four
+  adapters' duplicated `try { rule.run } catch { onCrash }` is now
+  `runRuleIsolated`, because that block is what the `rulesCrashed` count is
+  built on and seven copies mean seven chances to lose it.
+  The per-adapter _filter chain_ and budget check were deliberately **not**
+  folded into the existing `runRulesShared`: the TypeScript adapter injects
+  an AST, framework tags, a lazy `codeText` getter, config-only gating and
+  `configGateMatches`, and it _aborts the whole file_ on budget exhaustion
+  where `runRulesShared` only skips one rule. Routing every adapter through
+  it as written would have silently changed which rules run — the exact
+  unmeasured claim this program exists to delete.
+  `tests/contract/single-error-helper.spec.ts` holds the counts at one, and
+  pins the object arm so a future "simplification" cannot drop it.
+
+- **A crashed rule is no longer certified as a rule that stayed silent.**
+  The doc generator caught a rule THROW while running it against its own
+  must-not-fire fixture and returned `null`; the caller read that as
+  `fired: false` and committed, into a generated doc page and the
+  certification surface, the sentence _"Verified against … — a legitimate,
+  similar-looking pattern this rule correctly leaves alone."_ A detector that
+  crashes produces exactly the same absence of findings as one that correctly
+  abstains, so that claim had no evidence behind it — and it contradicted the
+  same function's own docstring, which says the field degrades honestly.
+  The outcome is now the tri-state the doctor's own model already defines:
+  `FIRED` (a real firewall violation), `DID_NOT_FIRE` (certified), and
+  `INCONCLUSIVE` (the rule did not run). An `INCONCLUSIVE` page says so and
+  says why, and it never renders the certification sentence. A missing
+  fixture is a fourth, separate thing — nothing was attempted — and says
+  that instead. The field is typed as a `FixtureOutcome` union rather than a
+  boolean, so reintroducing a derived `fired` flag does not typecheck.
+
+- **A human-facing table stopped sorting by code unit.** Pinning every
+  `localeCompare` to code-unit order (the fix for the ambient-locale drift)
+  made the per-rule corpus-occurrence table read
+  `SeleniumHQ-selenium` before `microsoft-playwright-dotnet`, because `S`
+  sorts before `m`. Stable, and worse to read than the alphabetical order the
+  table implies it has. That surface is a table a person chooses repos from,
+  so it now uses an **explicitly pinned** locale — readable order, identical
+  on every machine, which is the actual defect being avoided.
+
+- **Fifteen silent capability losses are now counted, and the count reaches the
+  report.** A `catch` in a detection path that returned a clean default made
+  the scan exit 0, report `analysisComplete`, and quietly lose the thing that
+  made its verdict trustworthy — the reader had no way to tell a whole scan
+  from a narrowed one. The worst case was `getCodeOnlyText` returning raw text
+  after a throw, which switches OFF the comment/string false-positive firewall
+  for that file rather than merely slowing it down. Every such site now records
+  a reason in one append-only ledger (`src/engine/degradation-ledger.ts`),
+  following the precedent already set by `parserRetryDegradationCount`, and the
+  scan result carries `analysisStatus.degradations` — reason-coded counts,
+  present only when something was actually lost, alongside a
+  `degraded:<reason>:<count>` entry in `reasons`. A non-empty set makes the
+  scan `partial`. `truncationReasons` is untouched: a degradation is not
+  truncation, and a reader must be able to tell "the scan stopped" from "the
+  scan lost a layer".
+  - Two distinctions the ledger refuses to blur. **Absent is not degraded:** a
+    Python, Java, Go or Rust repository has no `package.json`, and recording
+    that would mark every non-Node project partial while training readers to
+    ignore the field — so only a manifest that exists and will not parse
+    counts. **A no-AST adapter is not a downgrade either:** the same line
+    W1.4 draws for the deadline fallback.
+  - Two sites outside the original list were found by the new contract spec
+    and fixed in the same commit: the tree-sitter Java/C#/Python parses (left
+    alone, because the pipeline already counts every `parseAst → undefined` as
+    one parse fallback, and counting again would tally one file twice in two
+    different fields) and `hashDir`'s `readdirSync`, whose early `return`
+    omitted a whole subtree from the detector fingerprint — two rule trees
+    differing only inside an unreadable directory then hash identically, which
+    is a stale-cache hit wearing a fresh one's clothes.
+  - `mjolnir trend show` no longer prints "No trend data yet." and exits clean
+    for a history file whose every line failed to parse. The count of
+    discarded lines is now reported on stderr, and a history that exists but
+    cannot be read is `EXIT_INTERNAL` — the difference between no history and
+    unreadable history, which both used to arrive as the same empty array.
+  - `mjolnir explain` distinguishes _the rule found nothing_ from _the rule
+    never ran_. A rule that THREW on its own fixture produced the same output
+    as a correctly silent one, in the one surface whose purpose is to show
+    that a rule works. It now says so, with the reason.
+  - `tests/contract/no-uncounted-degradation.spec.ts` is the durable half: a
+    `catch` in the detection path that RETURNS A VALUE must record a reason,
+    rethrow, route to a counted sink, or be exempted with a stated failure
+    direction. The rule is about the _return_, not the `catch` — 37 of the 70
+    detection-path catches return nothing and cannot lie to a caller, and a
+    spec that listed all 70 as individual exemptions would be the same as no
+    exemption list at all.
+
+- **Scanning a subdirectory no longer reports a framework it read from its
+  parent.** `runScan` walks up past the target to find the project root, and
+  re-anchors the scan root to the target when the target is a strict
+  descendant — but it kept the discovered root's parsed `package.json`. So
+  `mjolnir scan monorepo/packages/foo` reported `jest` because
+  `monorepo/package.json` said so: a read outside the explicit scan root, and
+  a framework verdict about a tree nobody pointed at. Framework detection now
+  works from in-root evidence only (config files and the anchor's own
+  manifest), and reports `frameworkDetectionUnknown` when that evidence is
+  absent — an absent verdict you can see, rather than a parent's you cannot.
+  Scanning the project root itself is unchanged. This is the CLI counterpart
+  to the containment property the MCP workspace-boundary contract already
+  enforced.
+- **A scan that ran out of time no longer loses its AST stage silently.** When a
+  scan passes `--max-duration`, the remaining files were analyzed by regex
+  instead of AST — a different detection capability, not a slower version of the
+  same one, so the same tree produced different findings and a different score.
+  The mode was faithfully recorded in the scan cache and reported nowhere; the
+  only nearby disclosure, `file-budget`, fired incidentally because the
+  per-file rule-loop deadline was usually already spent too. Such a scan now
+  carries the truncation reason `ast-budget-fallback` and an
+  `analysisStatus.reasons` entry `ast-budget-fallback-files:<n>` saying how many
+  files were analyzed by regex, and is honestly `partial`. An adapter that
+  declares no AST stage at all (a YAML workflow, for instance) is a declared
+  capability envelope and is NOT reported as truncation. `truncationReasons` is
+  an open `string[]` by design, so consumers should test for members rather than
+  assert the exact array.
 - **`frontier:contracts` was reporting 19 suites it never ran.** It named 24
   test files; nineteen had been deleted by the `cc5fcb88` cleanup and its
   follow-up. Vitest treats a missing path as "no tests here" rather than an
@@ -285,6 +532,27 @@ were live in 3.0.0 and neither was in the plan.
 
 ### Known open, deliberately
 
+- [ ] **Trust certification is not claimed, and this release was authorized
+      without it.** `candidate:readiness` reports `BLOCKED` /
+      `INCONCLUSIVE` on all ten of its checks — candidate identity is not a
+      release candidate, the candidate SHA is not authorized, engineering
+      certification is not complete, and external validation, protected holdout
+      proof, real-world repository proof, the platform matrix, consumer install
+      proof and remote workflow proof are all absent.
+      `m26:audit` is likewise unsatisfied. Both ran, both printed, and neither
+      blocked the publish, because `vars.STABLE_RELEASE_AUTHORIZED` is `true` —
+      the same explicit override 4.0.0 shipped under.
+      The distinction is the point: **publication of a package is not the same
+      claim as a certification of it.** 5.0.0 asserts that the reporting
+      surface is honest, that a silent capability loss is disclosed, and that no
+      verdict is published without a measurement behind it. It does not assert
+      that a holdout corpus, a platform matrix and an external validation run
+      have been completed, because none of them have.
+      Consumers are not asked to take that on trust: the npm package publishes
+      the candidate manifest, which reads `NOT_CERTIFIED` and
+      `NOT_AUTHORIZED`, and every one of those ten blockers is enumerated above
+      rather than summarised. Closing them is the work that would make a
+      certification claim possible; it is not work this release did.
 - [ ] `CERTIFICATION_STATES` is not in ladder order, so `rankOf` — the only
       ordering function — ranks `KNOWN` above `TRUST-COMPLETE`, and
       `requiresEvidence` asks `BLOCKED` and `DEGRADED` for a corpus their own

package/README.br.md

@@ -18,7 +18,7 @@ e depois pontua até onde o resultado merece confiança, com a evidência de cad
 [![node](https://img.shields.io/badge/node-%E2%89%A5%2022.18-1F6F7C.svg?style=flat-square&labelColor=0A1119)](https://nodejs.org)
 
 ```bash
-npx mjolnir-qa@4.0.0
+npx mjolnir-qa@5.0.0
 ```
 
 [Veja funcionando](#veja-funcionando) · [Início rápido](#início-rápido) · [O que encontra](#o-que-o-mjölnir-encontra) · [Pontuação](#a-pontuação-de-confiabilidade) · [Evidência](#o-modelo-de-evidência) · [Forense](#forense-de-execução) · [CI](#integridade-de-ci) · [Agentes](#agentes-de-ia) · [Segurança](#confiança-e-segurança) · [Limites](#o-que-o-mjölnir-não-pode-dizer) · [Docs](#documentação)
@@ -72,7 +72,7 @@ Nenhum deles deixa o pipeline vermelho, e todos parecem intencionais na revisão
 
 <sub>Cada achado que o scan de demonstração reportou para este workflow, na linha reportada. Gerado por `npm run docs:readme-brand` a partir de [`demo-report.json`](assets/readme/demo-report.json) e travado contra desvios na CI.</sub>
 
-**Modo estrito.** As detecções mais agressivas — `.only`, `continue-on-error`, testes vazios, abuso de retry — ficam na quarentena. Só rodam com `--strict` e são limitadas a severidade `info`: elas sinalizam, nunca bloqueiam. O scan padrão (`npx mjolnir-qa@4.0.0` sem `--strict`) cobre apenas regras core e extended. Adicione `--strict` quando quiser a camada de consultoria também.
+**Modo estrito.** As detecções mais agressivas — `.only`, `continue-on-error`, testes vazios, abuso de retry — ficam na quarentena. Só rodam com `--strict` e são limitadas a severidade `info`: elas sinalizam, nunca bloqueiam. O scan padrão (`npx mjolnir-qa@5.0.0` sem `--strict`) cobre apenas regras core e extended. Adicione `--strict` quando quiser a camada de consultoria também.
 
 O Mjölnir lê a suíte, os workflows de CI e, se você tiver, o relatório de uma execução real. Ele não roda seus testes, não instala suas dependências e não executa o código que analisa. E quando não tem evidência, ele diz isso em vez de inventar confiança:
 
@@ -107,7 +107,7 @@ Um scan real de [`examples/demo-repo`](examples/demo-repo), uma pequena suíte P
 
 <p align="center">
   <a href="assets/video/mjolnir-demo.mp4">
-    <img src="assets/video/mjolnir-demo-poster.png" alt="Um quadro da gravação de demonstração: npx mjolnir-qa@4.0.0 analisando o repositório de demonstração em uma janela de terminal" width="900" />
+    <img src="assets/video/mjolnir-demo-poster.png" alt="Um quadro da gravação de demonstração: npx mjolnir-qa@5.0.0 analisando o repositório de demonstração em uma janela de terminal" width="900" />
   </a>
 </p>
 
@@ -176,7 +176,7 @@ Essa é a unidade de valor: um lugar onde a CI reporta uma aprovação que não
 ## Início rápido
 
 ```bash
-npx mjolnir-qa@4.0.0
+npx mjolnir-qa@5.0.0
 ```
 
 Ele analisa o diretório atual e imprime o Trust Report: o que encontrou, até onde você pode confiar, por quê e o que fazer em seguida. Sai com `0` quando nada foi encontrado no nível do gate ou acima.
@@ -184,7 +184,7 @@ Ele analisa o diretório atual e imprime o Trust Report: o que encontrou, até o
 Na CI, analise só o que a branch introduziu, para que uma suíte legada não afogue seu primeiro pull request:
 
 ```bash
-npx mjolnir-qa@4.0.0 --scope changed
+npx mjolnir-qa@5.0.0 --scope changed
 ```
 
 `mjolnir ci install` grava isso como um workflow do GitHub Actions, usando a [action](https://github.com/Sergey-Bar/Mjolnir#readme) fixada na tag principal `v3` (ou `npx` puro com `--no-action`). Ele continua consultivo até você decidir que deve bloquear.
@@ -492,7 +492,7 @@ Fixe `@v3` para acompanhar a linha principal, ou uma tag exata (`@v0.5.32`) para
 Para levar os achados ao GitHub Code Scanning, envie o SARIF (requer `security-events: write` no escopo do workflow ou job):
 
 ```yaml
-- run: npx mjolnir-qa@4.0.0 --format sarif > mjolnir.sarif
+- run: npx mjolnir-qa@5.0.0 --format sarif > mjolnir.sarif
   continue-on-error: true
 - uses: github/codeql-action/upload-sarif@v3
   if: ${{ !cancelled() }}
@@ -505,7 +505,7 @@ No GitLab, `--format codequality` grava o relatório do Code Quality que o widge
 ### Atribuição no escopo alterado
 
 ```bash
-npx mjolnir-qa@4.0.0 --scope changed
+npx mjolnir-qa@5.0.0 --scope changed
 ```
 
 Os achados são atribuídos às linhas que sua branch adicionou, medidas contra a **merge-base**. O escopo é o mesmo conjunto de arquivos que um scan completo descobre (specs TS/JS e configurações de adaptadores, `test_*.py`, `*Test.java`, `*Tests.cs`, `.github/workflows/*.yml`), mais as alterações não commitadas e não rastreadas, então funciona antes do commit. A base é resolvida como `main → master → origin/main → origin/master → origin/HEAD`; substitua com `--base <ref>`.
@@ -533,7 +533,7 @@ SCAN → EVIDENCE → HANDOFF → AGENT → RE-SCAN → PROOF
 Adicione-o a um cliente que tenha sua própria CLI:
 
 ```bash
-claude mcp add mjolnir -- npx -y mjolnir-qa@4.0.0 mcp
+claude mcp add mjolnir -- npx -y mjolnir-qa@5.0.0 mcp
 ```
 
 Ou a qualquer cliente que aceite um bloco `mcpServers`:
@@ -541,7 +541,7 @@ Ou a qualquer cliente que aceite um bloco `mcpServers`:
 ```json
 {
   "mcpServers": {
-    "mjolnir": { "command": "npx", "args": ["-y", "mjolnir-qa@4.0.0", "mcp"] }
+    "mjolnir": { "command": "npx", "args": ["-y", "mjolnir-qa@5.0.0", "mcp"] }
   }
 }
 ```
@@ -632,7 +632,7 @@ O ambiente de desenvolvimento, os comandos dos gates permanentes e as leis anti-
 <img src="assets/readme/closing.svg" alt="Rode no seu repo." width="100%" />
 
 ```bash
-npx mjolnir-qa@4.0.0
+npx mjolnir-qa@5.0.0
 ```
 
 [Leia o guia](https://sergey-bar.github.io/Mjolnir/guide/getting-started) · [Site de documentação](https://sergey-bar.github.io/Mjolnir/) · [npm](https://www.npmjs.com/package/mjolnir-qa)

package/README.md

@@ -18,7 +18,7 @@ when verification isn't earning its keep.
 [![node](https://img.shields.io/badge/node-%E2%89%A5%2022.18-1F6F7C.svg?style=flat-square&labelColor=0A1119)](https://nodejs.org)
 
 ```bash
-npx mjolnir-qa@4.0.0
+npx mjolnir-qa@5.0.0
 ```
 
 [See it work](#see-it-work) · [Quickstart](#quickstart) · [What it finds](#what-mjölnir-finds) · [Score](#the-worthiness-score) · [Evidence](#the-evidence-model) · [Forensics](#runtime-forensics) · [CI](#ci-integrity) · [Agents](#ai-agents) · [Security](#trust-and-security) · [Limits](#what-mjölnir-cannot-tell-you) · [Docs](#documentation)
@@ -67,7 +67,7 @@ reported. Generated by `npm run docs:readme-brand` from
 **Strict mode.** The most aggressive detections — `.only`, `continue-on-error`,
 empty tests, retry abuse — live in the quarantine tier. They run only
 under `--strict` and are capped to `info` severity: they flag, they never
-gate. The default scan (`npx mjolnir-qa@4.0.0` without `--strict`)
+gate. The default scan (`npx mjolnir-qa@5.0.0` without `--strict`)
 covers core and extended rules only. Add `--strict` when you want the
 advisory layer too.
 
@@ -127,7 +127,7 @@ CI. The full `--verbose` report of the same scan is
 
 <p align="center">
   <a href="assets/video/mjolnir-demo.mp4">
-    <img src="assets/video/mjolnir-demo-poster.png" alt="A frame of the demo recording: npx mjolnir-qa@4.0.0 scanning the demo repository in a terminal window" width="900" />
+    <img src="assets/video/mjolnir-demo-poster.png" alt="A frame of the demo recording: npx mjolnir-qa@5.0.0 scanning the demo repository in a terminal window" width="900" />
   </a>
 </p>
 
@@ -211,13 +211,13 @@ That is the unit of value: one place where CI reports a pass it did not earn.
 ## Quickstart
 
 ```bash
-npx mjolnir-qa@4.0.0
+npx mjolnir-qa@5.0.0
 ```
 
 Three steps to trust your release pipeline:
 
-1. **Scan** — `npx mjolnir-qa@4.0.0` — scans the current directory, prints the Trust Report, exits `1` if findings at the gate
-2. **Block in CI** — `npx mjolnir-qa@4.0.0 --scope changed` — scans only changed lines, blocks PRs with error findings
+1. **Scan** — `npx mjolnir-qa@5.0.0` — scans the current directory, prints the Trust Report, exits `1` if findings at the gate
+2. **Block in CI** — `npx mjolnir-qa@5.0.0 --scope changed` — scans only changed lines, blocks PRs with error findings
 3. **Fix and re-verify** — `mjolnir fix` applies safe auto-fixes, then re-scans to prove each one landed
 
 Install the advisory PR workflow first, so existing trust debt cannot break
@@ -627,14 +627,14 @@ In your existing workflow, pin the action and explicitly opt into an error gate:
 The `--blocking error` flag does the same in any CI pipeline:
 
 ```bash
-npx mjolnir-qa@4.0.0 --scope changed --blocking error
+npx mjolnir-qa@5.0.0 --scope changed --blocking error
 ```
 
 To put findings in GitHub Code Scanning, upload SARIF (requires
 `security-events: write` at workflow or job scope):
 
 ```yaml
-- run: npx mjolnir-qa@4.0.0 --format sarif > mjolnir.sarif
+- run: npx mjolnir-qa@5.0.0 --format sarif > mjolnir.sarif
   continue-on-error: true
 - uses: github/codeql-action/upload-sarif@v3
   if: ${{ !cancelled() }}
@@ -649,7 +649,7 @@ Editor and pipeline setup: [docs/SARIF-INTEGRATION.md](docs/SARIF-INTEGRATION.md
 ### Changed-scope attribution
 
 ```bash
-npx mjolnir-qa@4.0.0 --scope changed
+npx mjolnir-qa@5.0.0 --scope changed
 ```
 
 Findings are attributed to the lines your branch added, measured against
@@ -687,7 +687,7 @@ re-scan, never from the agent's own report of success.
 Add it to a client that ships its own CLI:
 
 ```bash
-claude mcp add mjolnir -- npx -y mjolnir-qa@4.0.0 mcp
+claude mcp add mjolnir -- npx -y mjolnir-qa@5.0.0 mcp
 ```
 
 Or to any client that takes an `mcpServers` block:
@@ -697,7 +697,7 @@ Or to any client that takes an `mcpServers` block:
   "mcpServers": {
     "mjolnir": {
       "command": "npx",
-      "args": ["-y", "mjolnir-qa@4.0.0", "mcp"]
+      "args": ["-y", "mjolnir-qa@5.0.0", "mcp"]
     }
   }
 }
@@ -839,7 +839,7 @@ fixture-firewall laws are in [CONTRIBUTING.md](CONTRIBUTING.md).
 <img src="assets/readme/closing.svg" alt="Run it on your repo." width="100%" />
 
 ```bash
-npx mjolnir-qa@4.0.0
+npx mjolnir-qa@5.0.0
 ```
 
 [Read the guide](https://sergey-bar.github.io/Mjolnir/guide/getting-started) · [Docs site](https://sergey-bar.github.io/Mjolnir/) · [npm](https://www.npmjs.com/package/mjolnir-qa)