mjolnir-qa 4.0.0 → 5.0.0

package/dist/mcp/stdio.mjs

@@ -85,6 +85,7 @@ const DEDUCTIONS = {
 //#region src/engine/completion.ts
 function deriveCompletion(input) {
 	const truncationReasons = [...new Set(input.truncationReasons)].sort();
+	const degradations = [...input.degradations ?? []].sort((a, b) => a.reason < b.reason ? -1 : a.reason > b.reason ? 1 : 0);
 	const reasons = /* @__PURE__ */ new Set();
 	if (input.discoveryTruncated) reasons.add("discovery-truncated");
 	if (input.rulesPartial) reasons.add("rules-partial");
@@ -94,14 +95,16 @@ function deriveCompletion(input) {
 	if (input.scopeUnrecognized > 0) reasons.add(`scope-unrecognized:${input.scopeUnrecognized}`);
 	if (input.parseFailed > 0) reasons.add(`parse-failed:${input.parseFailed}`);
 	if (input.parseFallbacks && input.parseFallbacks > 0) reasons.add(`parse-fallbacks:${input.parseFallbacks}`);
+	if (input.astFallbackFiles && input.astFallbackFiles > 0) reasons.add(`ast-budget-fallback-files:${input.astFallbackFiles}`);
 	if (input.scopeDegraded) reasons.add(`scope-degraded:${input.scopeDegraded}`);
 	if (input.runtimeIncomplete) reasons.add("runtime-incomplete");
 	if (input.identityIncomplete) reasons.add("identity-incomplete");
 	for (const reason of truncationReasons) reasons.add(`truncated:${reason}`);
+	for (const entry of degradations) reasons.add(`degraded:${entry.reason}:${entry.count}`);
 	const discoveryPartial = input.discoveryTruncated || input.scopeIgnored > 0 || input.scopeUnrecognized > 0 || input.scopeDegraded !== void 0;
 	const rulesPartial = input.rulesPartial || input.rulesCrashed > 0 || input.parseFailed > 0;
 	return {
-		partial: discoveryPartial || rulesPartial || input.skippedFiles > 0 || input.runtimeIncomplete === true || input.identityIncomplete === true || truncationReasons.length > 0,
+		partial: discoveryPartial || rulesPartial || input.skippedFiles > 0 || input.runtimeIncomplete === true || input.identityIncomplete === true || truncationReasons.length > 0 || degradations.length > 0,
 		analysisStatus: {
 			discovery: discoveryPartial ? "partial" : "complete",
 			rules: rulesPartial ? "partial" : "complete",
@@ -109,11 +112,49 @@ function deriveCompletion(input) {
 			rulesCrashed: input.rulesCrashed,
 			parseFallbacks: input.parseFallbacks ?? 0,
 			...truncationReasons.length > 0 ? { truncationReasons } : {},
+			...degradations.length > 0 ? { degradations } : {},
 			reasons: [...reasons].sort()
 		}
 	};
 }
 //#endregion
+//#region src/engine/degradation-ledger.ts
+/**
+* Append-only. Records are never edited and never removed by a recording
+* site; a reader takes a window, and the window is defined by index, so
+* "delete my entry" is not an operation this module offers.
+*/
+const records = [];
+/** Record one capability loss. `count` is for a site that fails N at once. */
+function recordDegradation(reason, count = 1) {
+	if (!Number.isInteger(count) || count < 1) return;
+	for (let index = 0; index < count; index++) records.push({ reason });
+}
+/**
+* Mark where this reader's window opens. Everything appended from here on is
+* what the reader will see; see the file header for what a concurrent scan
+* does to that boundary.
+*/
+function beginDegradationWindow() {
+	return records.length;
+}
+/** The records appended since `marker`, without consuming them. */
+function degradationsSince(marker) {
+	return records.slice(marker);
+}
+/**
+* Per-reason counts for a window, sorted by reason so the output is
+* byte-deterministic for the same set of degradations.
+*/
+function summarizeDegradations(window) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const record of window) counts.set(record.reason, (counts.get(record.reason) ?? 0) + 1);
+	return [...counts.entries()].map(([reason, count]) => ({
+		reason,
+		count
+	})).sort((a, b) => a.reason < b.reason ? -1 : a.reason > b.reason ? 1 : 0);
+}
+//#endregion
 //#region src/engine/runtime-corroboration.ts
 /**
 * Stamp runtime corroboration + trust levels onto findings (mutates in
@@ -1064,6 +1105,120 @@ function createExecutor(name, concurrency, runOne) {
 	};
 }
 //#endregion
+//#region src/scope/git-resolve.ts
+/**
+* Absolute-path git resolution (audit S1).
+*
+* `execFileSync("git", …)` resolves through PATH — including the CWD on
+* Windows (CreateProcess searches the current directory before PATH for
+* extension-less names depending on NoDefaultCurrentDirectoryInExePath).
+* Scanning an UNTRUSTED repo therefore let a checked-in `git.exe` (or
+* `git.bat`/`git.cmd`) hijack Mjölnir's own git invocations: the attacker
+* controls the diff output, the merge-base decision, and
+* `--scope changed`'s "what is new" answer — the exact data CI gates on.
+*
+* The fix: resolve git ONCE per process to an ABSOLUTE path by walking
+* the PATH directly (never consulting the CWD), verify the candidate is
+* an existing file, and pass that path to execFileSync. Resolution is
+* memoized; a failure to find a real git anywhere on PATH is recorded
+* and callers degrade without invoking a bare name.
+*/
+let resolvedGit = void 0;
+/**
+* The absolute path of the git binary Mjölnir will invoke, or null when
+* PATH carries no executable `git` at all. Callers must degrade without
+* invoking a bare name.
+*/
+function resolveGitPath() {
+	if (resolvedGit !== void 0) return resolvedGit;
+	const candidates = [process.platform === "win32" ? "git.exe" : "git"];
+	if (process.platform === "win32") {
+		const pathExt = process.env["PATHEXT"]?.split(";").filter(Boolean) ?? [];
+		for (const ext of pathExt) candidates.push(`git${ext.toLowerCase()}`);
+	}
+	const pathValue = process.env["PATH"] ?? "";
+	for (const dir of pathValue.split(delimiter)) {
+		if (dir === "") continue;
+		if (!isAbsolute(dir)) continue;
+		for (const candidate of candidates) {
+			const full = join(dir, candidate);
+			try {
+				if (existsSync(full)) {
+					resolvedGit = full;
+					return resolvedGit;
+				}
+			} catch {}
+		}
+	}
+	`${pathValue.length}`;
+	resolvedGit = null;
+	return resolvedGit;
+}
+/**
+* Run git with the S1-resolved absolute binary path. Returns stdout, or
+* null when git is missing or the command fails — the same contract as
+* the previous inline `git()` helpers, with the hijack surface closed.
+*/
+function runGit(root, args) {
+	const exe = resolveGitPath();
+	if (!exe) return null;
+	try {
+		return execFileSync(exe, [
+			"-C",
+			root,
+			...args
+		], {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			timeout: 15e3
+		});
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/lib/safe-json.ts
+/**
+* Reusable safe-JSON parse-and-validate helper.
+*
+* Replaces the `JSON.parse(text) as T` pattern with a two-step process:
+*   1. Try/catch around JSON.parse (descriptive error on bad JSON)
+*   2. Runtime validation of the parsed shape (caller-supplied predicate)
+*
+* The `validate` predicate is intentionally lightweight — it checks the
+* expected shape exists rather than exhaustively type-guarding every field.
+* Internal files (cache, hashes) use `isRecord`; user-facing files
+* (config, plugins) use stricter checks that throw descriptive errors.
+*/
+const MAX_JSON_BYTES = 16777216;
+function parseJsonFile(text, source, validate) {
+	if (Buffer.byteLength(text, "utf8") > MAX_JSON_BYTES) throw new Error(`JSON source exceeds the ${MAX_JSON_BYTES}-byte limit: ${source}`);
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch (err) {
+		throw new Error(`invalid JSON in ${source}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+	}
+	if (!validate(parsed)) throw new Error(`unexpected shape in ${source}`, { cause: parsed });
+	return parsed;
+}
+/**
+* Minimal validator: value is a plain object (not null, not array).
+* Sufficient for internal files (cache, hashes) where downstream
+* code already checks individual fields.
+*/
+function isRecord(v) {
+	try {
+		return typeof v === "object" && v !== null && !Array.isArray(v);
+	} catch {
+		return false;
+	}
+}
+//#endregion
 //#region src/engine/candidate-binding.ts
 /**
 * Candidate binding (plan V5-010).
@@ -1084,9 +1239,6 @@ const SHA40 = /^[a-f0-9]{40}$/;
 const SHA256 = /^[a-f0-9]{64}$/;
 const STATES = ["WORKING_CANDIDATE", "RELEASE_CANDIDATE"];
 const AUTHORIZATION = ["NOT_AUTHORIZED", "AUTHORIZED"];
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function sha256File(path) {
 	try {
 		return createHash("sha256").update(readFileSync(path)).digest("hex");
@@ -1094,17 +1246,41 @@ function sha256File(path) {
 		return;
 	}
 }
+/**
+* One git line, or nothing.
+*
+* Audit S1: the binary is the ABSOLUTE path `resolveGitPath()` found by
+* walking PATH itself, never the bare name. `bindRepository()` runs on every
+* scan (`scan-pipeline.ts`), and a bare `execFileSync("git", …)` lets a
+* `git.exe`/`git.bat`/`git.cmd` CHECKED INTO AN UNTRUSTED REPO hijack the
+* call on Windows, where CreateProcess searches the current directory before
+* PATH. The attacker then controls the `commit` and `tree` that land in
+* `runIdentity` and the evidence graph — the provenance a release decision
+* reads. This was the last bare-name exec left in `src/`; the invariant that
+* keeps it that way is `tests/contract/no-bare-process-exec.spec.ts`.
+*
+* The `-C <root>` shape (not `cwd`) matches every other hardened call site.
+* With no git on PATH at all, the answer is nothing — a scan of an unpacked
+* tarball has no commit, and its identity must say so rather than carrying a
+* placeholder that looks like provenance.
+*/
 function gitLine(root, args) {
+	const exe = resolveGitPath();
+	if (!exe) return void 0;
 	try {
-		const trimmed = execFileSync("git", args, {
-			cwd: root,
+		const trimmed = execFileSync(exe, [
+			"-C",
+			root,
+			...args
+		], {
 			encoding: "utf8",
 			stdio: [
 				"ignore",
 				"pipe",
 				"ignore"
 			],
-			windowsHide: true
+			windowsHide: true,
+			timeout: 15e3
 		}).trim();
 		return trimmed.length > 0 ? trimmed : void 0;
 	} catch {
@@ -1135,9 +1311,9 @@ function bindRepository(root) {
 * contradiction the release decision evaluator treats as BLOCKED).
 */
 function parseCandidateBinding(raw) {
-	if (!isRecord$1(raw)) return null;
+	if (!isRecord(raw)) return null;
 	const identity = raw.identity;
-	if (!isRecord$1(identity)) return null;
+	if (!isRecord(identity)) return null;
 	const state = identity.state;
 	const candidateSha = identity.candidateSha;
 	const baseSha = identity.baseSha;
@@ -1186,7 +1362,7 @@ function readCandidateBinding(root, manifestPath = CANDIDATE_MANIFEST_PATH) {
 * scripts/sync-sarif-version.cjs and guarded by the version-consistency
 * spec. cli.ts re-exports this as CLI_VERSION.
 */
-const ENGINE_VERSION = "4.0.0";
+const ENGINE_VERSION = "5.0.0";
 //#endregion
 //#region src/engine/contract-versions.ts
 /**
@@ -1315,9 +1491,12 @@ function discoverWorkspace(rootDir) {
 	const root = findProjectRoot(rootDir);
 	if (!root) return null;
 	let pkg = {};
-	try {
-		pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
-	} catch {}
+	const manifestPath = join(root, "package.json");
+	if (existsSync(manifestPath)) try {
+		pkg = JSON.parse(readFileSync(manifestPath, "utf8"));
+	} catch {
+		recordDegradation("workspace-manifest-unreadable");
+	}
 	const rawWorkspaces = pkg["workspaces"];
 	let globs = [];
 	if (Array.isArray(rawWorkspaces)) globs = rawWorkspaces.filter((w) => typeof w === "string");
@@ -1334,40 +1513,6 @@ function basename$1(p) {
 	return parts[parts.length - 1];
 }
 //#endregion
-//#region src/lib/safe-json.ts
-/**
-* Reusable safe-JSON parse-and-validate helper.
-*
-* Replaces the `JSON.parse(text) as T` pattern with a two-step process:
-*   1. Try/catch around JSON.parse (descriptive error on bad JSON)
-*   2. Runtime validation of the parsed shape (caller-supplied predicate)
-*
-* The `validate` predicate is intentionally lightweight — it checks the
-* expected shape exists rather than exhaustively type-guarding every field.
-* Internal files (cache, hashes) use `isRecord`; user-facing files
-* (config, plugins) use stricter checks that throw descriptive errors.
-*/
-const MAX_JSON_BYTES = 16777216;
-function parseJsonFile(text, source, validate) {
-	if (Buffer.byteLength(text, "utf8") > MAX_JSON_BYTES) throw new Error(`JSON source exceeds the ${MAX_JSON_BYTES}-byte limit: ${source}`);
-	let parsed;
-	try {
-		parsed = JSON.parse(text);
-	} catch (err) {
-		throw new Error(`invalid JSON in ${source}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
-	}
-	if (!validate(parsed)) throw new Error(`unexpected shape in ${source}`, { cause: parsed });
-	return parsed;
-}
-/**
-* Minimal validator: value is a plain object (not null, not array).
-* Sufficient for internal files (cache, hashes) where downstream
-* code already checks individual fields.
-*/
-function isRecord(v) {
-	return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-//#endregion
 //#region src/lib/fs-bounded.ts
 function closeQuiet(fd) {
 	try {
@@ -1597,6 +1742,12 @@ function validate(cfg, knownRuleIds) {
 * Expiry is evaluated only from an explicit ISO `expires` date. A missing
 * date remains active and is reported as having no expiry. Config-file mtime
 * is never an expiry anchor.
+*
+* `now` defaults to the current instant so existing callers stay correct, but
+* a verdict function that reads the clock invisibly is a verdict nobody can
+* test at a boundary. `tests/contract/deterministic-clock.spec.ts` audits
+* `src/config/**` for a call site that supplies its own `new Date()` instead
+* of threading one through.
 */
 function isSuppressionActive(ign, now = /* @__PURE__ */ new Date()) {
 	if (!ign.expires) return true;
@@ -1992,6 +2143,7 @@ function parseTsFile(file) {
 		}
 		return p.createSourceFile(file.path, file.text);
 	} catch {
+		recordDegradation("ast-parse-failed");
 		return;
 	}
 }
@@ -2047,6 +2199,7 @@ function commentAndStringRanges(ctx) {
 		}
 		return ranges;
 	} catch {
+		recordDegradation("ast-range-scan-failed");
 		return [];
 	}
 }
@@ -2094,6 +2247,7 @@ function getCodeOnlyText(file) {
 		for (const r of ranges) for (let i = r.start; i < r.end && i < chars.length; i++) if (chars[i] !== "\n" && chars[i] !== "\r") chars[i] = " ";
 		return chars.join("");
 	} catch {
+		recordDegradation("ast-mask-unavailable");
 		return file.text;
 	}
 }
@@ -2478,6 +2632,44 @@ function frameworkFilterApplies(rule, file) {
 	return rule.frameworks.some((f) => tags.includes(f));
 }
 //#endregion
+//#region src/engine/shared-run-rules.ts
+/**
+* Run ONE rule with crash isolation, and return what it produced.
+*
+* This is the block that was copy-pasted into all seven language adapters:
+*
+*   try { for (const f of rule.run(x)) emit(f, rule.id, rule.category); }
+*   catch (error) { onCrash?.(rule.id, error); }
+*
+* Extracting it is worth doing for one reason beyond line count. Crash
+* isolation is the mechanism that lets a third-party or experimental
+* detector fail without ending a scan, and it is the mechanism the whole
+* `rulesCrashed` count depends on. Seven copies means seven chances to
+* write `catch {}` and lose the count, and `tests/contract/
+* no-uncounted-degradation.spec.ts` can only audit what it can see.
+*
+* `null` means the rule CRASHED, which is not the same as an empty array:
+* an empty array is the rule abstaining, and the adapters skip emission for
+* both but the distinction is why the caller must not conflate them.
+*
+* Deliberately NOT extracted: the per-adapter filter chain and the budget
+* check. Those genuinely differ — the TypeScript adapter injects an AST,
+* framework tags, a lazy `codeText` getter, `appliesTo` scoping, config-only
+* gating and `configGateMatches`, and it ABORTS the whole file on budget
+* exhaustion where `runRulesShared` only `continue`s to the next rule.
+* Routing every adapter through `runRulesShared` as written would silently
+* change which rules run and when, which is precisely the unmeasured claim
+* this program exists to delete. This helper takes the part they share.
+*/
+function runRuleIsolated(rule, file, onCrash) {
+	try {
+		return rule.run(file);
+	} catch (error) {
+		onCrash?.(rule.id, error);
+		return null;
+	}
+}
+//#endregion
 //#region src/adapters/typescript.ts
 /**
 * TypeScript/JavaScript adapter (R1).
@@ -2687,11 +2879,9 @@ const typescriptAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run(enriched)) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, enriched, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -2719,6 +2909,7 @@ function loadWorkspaceShim(root) {
 			workspaceGlobs: []
 		};
 	} catch {
+		recordDegradation("workspace-manifest-unreadable");
 		return null;
 	}
 }
@@ -3073,11 +3264,9 @@ const pythonAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run(enriched)) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, enriched, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	},
 	async parseAst(file) {
@@ -3230,11 +3419,9 @@ const javaAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run(enriched)) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, enriched, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -3388,11 +3575,9 @@ const csharpAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run(enriched)) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, enriched, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -3570,6 +3755,7 @@ const githubActionsAdapter = {
 		try {
 			entries = readdirSync(wfDir);
 		} catch {
+			recordDegradation("ci-workflow-listing-unreadable");
 			return;
 		}
 		for (const name of entries) {
@@ -3610,15 +3796,13 @@ const githubActionsAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run({
-					path: file.path,
-					text: file.text,
-					ast: doc
-				})) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, {
+				path: file.path,
+				text: file.text,
+				ast: doc
+			}, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -3928,15 +4112,13 @@ const azurePipelinesAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run({
-					path: file.path,
-					text: file.text,
-					ast: doc
-				})) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, {
+				path: file.path,
+				text: file.text,
+				ast: doc
+			}, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -4007,14 +4189,12 @@ const jenkinsAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run({
-					path: file.path,
-					text: file.text
-				})) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, {
+				path: file.path,
+				text: file.text
+			}, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -4141,82 +4321,6 @@ function isInsideSkippedDir(root, absPath, skipNames) {
 }
 typescriptAdapter.testFileGlobs, pythonAdapter.testFileGlobs, javaAdapter.testFileGlobs, csharpAdapter.testFileGlobs, githubActionsAdapter.testFileGlobs, azurePipelinesAdapter.testFileGlobs, jenkinsAdapter.testFileGlobs;
 //#endregion
-//#region src/scope/git-resolve.ts
-/**
-* Absolute-path git resolution (audit S1).
-*
-* `execFileSync("git", …)` resolves through PATH — including the CWD on
-* Windows (CreateProcess searches the current directory before PATH for
-* extension-less names depending on NoDefaultCurrentDirectoryInExePath).
-* Scanning an UNTRUSTED repo therefore let a checked-in `git.exe` (or
-* `git.bat`/`git.cmd`) hijack Mjölnir's own git invocations: the attacker
-* controls the diff output, the merge-base decision, and
-* `--scope changed`'s "what is new" answer — the exact data CI gates on.
-*
-* The fix: resolve git ONCE per process to an ABSOLUTE path by walking
-* the PATH directly (never consulting the CWD), verify the candidate is
-* an existing file, and pass that path to execFileSync. Resolution is
-* memoized; a failure to find a real git anywhere on PATH is recorded
-* and callers degrade without invoking a bare name.
-*/
-let resolvedGit = void 0;
-/**
-* The absolute path of the git binary Mjölnir will invoke, or null when
-* PATH carries no executable `git` at all. Callers must degrade without
-* invoking a bare name.
-*/
-function resolveGitPath() {
-	if (resolvedGit !== void 0) return resolvedGit;
-	const candidates = [process.platform === "win32" ? "git.exe" : "git"];
-	if (process.platform === "win32") {
-		const pathExt = process.env["PATHEXT"]?.split(";").filter(Boolean) ?? [];
-		for (const ext of pathExt) candidates.push(`git${ext.toLowerCase()}`);
-	}
-	const pathValue = process.env["PATH"] ?? "";
-	for (const dir of pathValue.split(delimiter)) {
-		if (dir === "") continue;
-		if (!isAbsolute(dir)) continue;
-		for (const candidate of candidates) {
-			const full = join(dir, candidate);
-			try {
-				if (existsSync(full)) {
-					resolvedGit = full;
-					return resolvedGit;
-				}
-			} catch {}
-		}
-	}
-	`${pathValue.length}`;
-	resolvedGit = null;
-	return resolvedGit;
-}
-/**
-* Run git with the S1-resolved absolute binary path. Returns stdout, or
-* null when git is missing or the command fails — the same contract as
-* the previous inline `git()` helpers, with the hijack surface closed.
-*/
-function runGit(root, args) {
-	const exe = resolveGitPath();
-	if (!exe) return null;
-	try {
-		return execFileSync(exe, [
-			"-C",
-			root,
-			...args
-		], {
-			encoding: "utf8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			],
-			timeout: 15e3
-		});
-	} catch {
-		return null;
-	}
-}
-//#endregion
 //#region src/scope/changed.ts
 /**
 * Changed-scope engine (Sprint-Plan W6, Product-MVP §9 `--scope changed`).
@@ -11657,6 +11761,53 @@ function getRule(id) {
 	return RULES.find((r) => r.id === id);
 }
 //#endregion
+//#region src/lib/compare.ts
+/**
+* Order that does not depend on who is asking.
+*
+* `String.prototype.localeCompare` with no locale argument resolves against
+* the PROCESS's default locale — the ICU collation chosen by `LANG`,
+* `LC_ALL` or the OS. So a sort written as
+* `[...xs].sort((a, b) => a.localeCompare(b))` produces a different order on
+* a developer's `de_DE` machine than on an en-US CI runner. For a display
+* list that is a nuisance; for anything that reaches a hash, a cache key, a
+* digest or a machine contract it is a correctness bug, because the same
+* repository then produces two different fingerprints.
+*
+* Two comparators, one per kind of site:
+*
+*   compareCodePoints — pure UTF-16 code-unit order. Identical everywhere,
+*   independent of ICU version, and already what `Array.prototype.sort`
+*   defaults to. Use for every value that reaches a fingerprint, a digest,
+*   a cache key, or a contract, and for any ordering with no human-facing
+*   reason to be pretty.
+*
+*   compareLocalized(locale) — the same collator, PINNED to a named locale
+*   instead of inheriting the environment, for a surface that genuinely
+*   wants readable order (a table of rule titles, a Mermaid legend). Pinned
+*   rather than removed because a reader-facing list of "Test / Logic /
+*   Mock" should not be ordered by code unit.
+*
+* A bare `localeCompare` with no second argument in `src/` is a defect and
+* `tests/contract/deterministic-ordering.spec.ts` fails the build on it.
+*/
+/** Code-unit order. Locale-free, ICU-free, and the Array.sort default. */
+function compareCodePoints(a, b) {
+	if (a === b) return 0;
+	return a < b ? -1 : 1;
+}
+/**
+* A readable-order comparator pinned to `locale`.
+*
+* The pin is the point: `a.localeCompare(b)` reads the environment, and the
+* environment is a machine setting, not a property of the code. Callers that
+* want stable output ask for a named locale and get the same answer on every
+* machine that ships the same ICU data.
+*/
+function compareLocalized(locale) {
+	return (a, b) => a.localeCompare(b, locale);
+}
+//#endregion
 //#region src/scorer/scorer.ts
 /**
 * Transparent scorer (Product-MVP §8).
@@ -11713,7 +11864,7 @@ function computeDimensions(findings) {
 		deductions.set(f.category, deductions.get(f.category) + deductionFor(f));
 	}
 	for (const dim of byCategory.values()) dim.score = Math.max(0, 100 - deductions.get(dim.category));
-	return [...byCategory.values()].sort((a, b) => a.category.localeCompare(b.category));
+	return [...byCategory.values()].sort((a, b) => compareCodePoints(a.category, b.category));
 }
 /**
 * Deduction-mass ceilings (product-gap-remediation master plan P2,
@@ -12155,7 +12306,7 @@ function groupByRootCause(findings) {
 function correlateFindings(findings) {
 	const conclusions = [];
 	const rootCauseGroups = groupByRootCause(findings);
-	for (const [rootCause, group] of Array.from(rootCauseGroups.entries()).sort((a, b) => a[0].localeCompare(b[0]))) {
+	for (const [rootCause, group] of Array.from(rootCauseGroups.entries()).sort((a, b) => compareLocalized("en")(a[0], b[0]))) {
 		if (group.length < 2) continue;
 		const findingIds = group.map((f) => f.findingId ?? f.ruleId);
 		conclusions.push({
@@ -12167,7 +12318,7 @@ function correlateFindings(findings) {
 		});
 	}
 	const fileGroups = groupByFile(findings);
-	for (const [file, group] of Array.from(fileGroups.entries()).sort((a, b) => a[0].localeCompare(b[0]))) {
+	for (const [file, group] of Array.from(fileGroups.entries()).sort((a, b) => compareCodePoints(a[0], b[0]))) {
 		if (group.length < 2) continue;
 		const alreadyConvergent = /* @__PURE__ */ new Set();
 		for (const c of conclusions) if (c.conclusionType === "CONVERGENT") for (const id of c.findingIds) alreadyConvergent.add(id);
@@ -12918,9 +13069,10 @@ function hashDir(dir, hash, depth) {
 	try {
 		entries = readdirSync(dir, { withFileTypes: true });
 	} catch {
+		recordDegradation("rules-tree-listing-unreadable");
 		return;
 	}
-	entries.sort((a, b) => a.name.localeCompare(b.name));
+	entries.sort((a, b) => compareCodePoints(a.name, b.name));
 	for (const entry of entries) {
 		if (entry.name === "node_modules" || entry.name === ".git") continue;
 		const full = join(dir, entry.name);
@@ -14319,11 +14471,11 @@ function listFiles(dir) {
 	return out.map((p) => p);
 }
 plainContext();
-function loadSuppressions(root) {
+function loadSuppressions(root, now = /* @__PURE__ */ new Date()) {
 	const { config } = loadConfig(root);
 	const entries = (config.ignore ?? []).map((ign) => ({
 		...ign,
-		status: isSuppressionActive(ign, /* @__PURE__ */ new Date()) ? "active" : "expired"
+		status: isSuppressionActive(ign, now) ? "active" : "expired"
 	}));
 	return {
 		total: entries.length,
@@ -15056,6 +15208,7 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 	let rulesPartial = false;
 	let parseFailed = 0;
 	let parseFallbacks = 0;
+	let astFallbackFiles = 0;
 	let scanned = 0;
 	let analyzed = 0;
 	for (const path of testFiles) {
@@ -15099,6 +15252,10 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 			});
 		}
 		const wantsAst = adapter.parseAst !== void 0 && Date.now() <= deadline;
+		if (adapter.parseAst !== void 0 && !wantsAst) {
+			truncationReasons.add("ast-budget-fallback");
+			astFallbackFiles++;
+		}
 		const identity = (mode) => ({
 			relPath,
 			adapterId: adapter.id,
@@ -15216,7 +15373,8 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 		parseFailed,
 		parseFallbacks,
 		scanned,
-		analyzed
+		analyzed,
+		astFallbackFiles
 	};
 }
 /**
@@ -15444,6 +15602,8 @@ function assembleScanResult(o) {
 		scopeUnrecognized: o.scopeUnrecognized,
 		parseFailed: o.parseFailed,
 		parseFallbacks: o.parseFallbacks ?? 0,
+		...o.astFallbackFiles !== void 0 ? { astFallbackFiles: o.astFallbackFiles } : {},
+		...o.degradations !== void 0 ? { degradations: o.degradations } : {},
 		...o.scopeInfo.degraded !== void 0 ? { scopeDegraded: o.scopeInfo.degraded } : {},
 		...o.runtimeIncomplete !== void 0 ? { runtimeIncomplete: o.runtimeIncomplete } : {},
 		identityIncomplete
@@ -15562,13 +15722,15 @@ function assembleScanResult(o) {
 */
 async function runScan(args, hooks = {}) {
 	const started = Date.now();
+	const degradationWindow = beginDegradationWindow();
 	const requestedDuration = Number.isFinite(args.maxDurationMs) ? args.maxDurationMs : DEFAULT_MAX_DURATION_MS$1;
 	const deadline = started + Math.min(Math.max(1, requestedDuration), MAX_DURATION_MS$1);
 	const discovered = discoverWorkspace(args.target);
 	const targetAbs = resolve(args.target);
 	const scanRoot = discovered && discovered.root !== targetAbs && targetAbs.startsWith(discovered.root + sep) ? {
 		...discovered,
-		root: targetAbs
+		root: targetAbs,
+		packageJson: {}
 	} : discovered ?? fallbackWorkspace(targetAbs);
 	const workspace = scanRoot;
 	if (args.verbose) hooks.onConfigWarning?.(`verbose: scan root (config/ignore anchor): ${workspace.root}`);
@@ -15653,6 +15815,7 @@ async function runScan(args, hooks = {}) {
 	rulesPartial = analysis.rulesPartial;
 	parseFailed = analysis.parseFailed;
 	const parseFallbacks = analysis.parseFallbacks;
+	const astFallbackFiles = analysis.astFallbackFiles;
 	const scanned = analysis.scanned;
 	const analyzed = analysis.analyzed;
 	const postScan = applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, declarationsByFile, testDeclarationCount, tierByRuleId, REVISION_BY_RULE_ID);
@@ -15671,6 +15834,8 @@ async function runScan(args, hooks = {}) {
 		scopeUnrecognized,
 		parseFailed,
 		parseFallbacks,
+		astFallbackFiles,
+		degradations: summarizeDegradations(degradationsSince(degradationWindow)),
 		scanned,
 		analyzed,
 		testFiles,
@@ -15697,6 +15862,39 @@ async function runScan(args, hooks = {}) {
 	resetTsMorphProject();
 	return result;
 }
+//#endregion
+//#region src/cli-io.ts
+/**
+* The ONE error-to-message derivation in `src/`.
+*
+* This tree carried four near-copies: two `errorMessage` (byte-identical) and
+* two `errorText`. The two `errorText` copies were not identical, which is the
+* part that mattered — `String(someObject)` renders `[object Object]`, so the
+* copy that lost the payload turned a hostile non-Error throw into a message
+* that names nothing. The richer arms are kept here, so every call site gets
+* the informative one and the difference stops being a per-file accident.
+*
+* The arms, in order:
+*   Error            -> `.message`. The 99% case, and the only one that
+*                       carries a stack the caller may still want.
+*   string           -> itself. A thrown string is already the message.
+*   plain object     -> `JSON.stringify`. A non-Error throw of `{ code:
+*                       "EISDIR" }` is a REAL failure shape in Node, and
+*                       `[object Object]` hides the only field that says
+*                       what went wrong.
+*   anything else    -> `String(err)`. Symbols and undefined included, so
+*                       nothing vanishes.
+*
+* The call this replaces was `err instanceof Error ? err.message : String(err)`
+* in `src/mcp/server.ts` and `src/commands/doctor.ts`; `tests/cli/summary.spec.ts`
+* already pins the object arm.
+*/
+function errorMessage(err) {
+	if (err instanceof Error) return err.message;
+	if (typeof err === "string") return err;
+	if (typeof err === "object" && err !== null) return JSON.stringify(err);
+	return String(err);
+}
 /**
 * Fields that participate in the verification digest: identity (ruleId,
 * detectorRevision, file, line, column) + evidence (severity,
@@ -15849,6 +16047,11 @@ function explainRule(ruleId, fixturesRoot) {
 		ok: false,
 		error: `Unknown rule ID "${ruleId}". Run \`mjolnir rules\` for the full catalog.`
 	};
+	const window = beginDegradationWindow();
+	const degraded = () => {
+		const counts = summarizeDegradations(degradationsSince(window));
+		return counts.length > 0 ? { exampleDegraded: counts } : {};
+	};
 	const fixturePath = firstFixtureFile(join(fixturesRoot, ruleId, "must-fire"));
 	if (!fixturePath) return {
 		ok: true,
@@ -15858,9 +16061,11 @@ function explainRule(ruleId, fixturesRoot) {
 	try {
 		text = readFileSync(fixturePath, "utf8").replace(/\r\n/g, "\n");
 	} catch {
+		recordDegradation("explain-fixture-unreadable");
 		return {
 			ok: true,
-			rule
+			rule,
+			...degraded()
 		};
 	}
 	const normalizedPath = fixturePath.replaceAll("\\", "/");
@@ -15870,9 +16075,11 @@ function explainRule(ruleId, fixturesRoot) {
 		else try {
 			ast = isAzurePipelineFixture(normalizedPath) ? parseAzurePipeline(text) : parseWorkflow(text);
 		} catch {
+			recordDegradation("explain-workflow-parse-failed");
 			return {
 				ok: true,
-				rule
+				rule,
+				...degraded()
 			};
 		}
 	}
@@ -15889,9 +16096,11 @@ function explainRule(ruleId, fixturesRoot) {
 			codeText
 		});
 	} catch {
+		recordDegradation("explain-rule-crash");
 		return {
 			ok: true,
-			rule
+			rule,
+			...degraded()
 		};
 	}
 	const example = findings[0];
@@ -16652,15 +16861,11 @@ async function handleToolCall(call) {
 			id: call.id,
 			error: {
 				code: MCP_ERRORS.INTERNAL,
-				message: errorMessage$1(err)
+				message: errorMessage(err)
 			}
 		};
 	}
 }
-/** Normalize any thrown value to a string (unit-tested both arms). */
-function errorMessage$1(err) {
-	return err instanceof Error ? err.message : String(err);
-}
 /** JSON-RPC request shape validation (strict — §21). */
 function validateRequest(msg) {
 	if (typeof msg !== "object" || msg === null) return {
@@ -16763,14 +16968,6 @@ async function handleMcpMessage(msg) {
 	};
 }
 //#endregion
-//#region src/cli-io.ts
-/**
-* The single error-to-message derivation shared by every catch site:
-* Error instances render their message; anything else is stringified
-* honestly (a hostile non-Error throw must surface, not vanish).
-*/
-const errorMessage = (err) => err instanceof Error ? err.message : String(err);
-//#endregion
 //#region src/mcp/transport.ts
 /**
 * MCP stdio transport loop (blueprint §21 — the framing around the