mjolnir-qa 4.0.0 → 5.0.0

package/dist/{scan-pipeline-CCJdEKNa.mjs → scan-pipeline-DT8DWAMl.mjs}

@@ -126,6 +126,7 @@ const DEDUCTIONS = {
 //#region src/engine/completion.ts
 function deriveCompletion(input) {
 	const truncationReasons = [...new Set(input.truncationReasons)].sort();
+	const degradations = [...input.degradations ?? []].sort((a, b) => a.reason < b.reason ? -1 : a.reason > b.reason ? 1 : 0);
 	const reasons = /* @__PURE__ */ new Set();
 	if (input.discoveryTruncated) reasons.add("discovery-truncated");
 	if (input.rulesPartial) reasons.add("rules-partial");
@@ -135,14 +136,16 @@ function deriveCompletion(input) {
 	if (input.scopeUnrecognized > 0) reasons.add(`scope-unrecognized:${input.scopeUnrecognized}`);
 	if (input.parseFailed > 0) reasons.add(`parse-failed:${input.parseFailed}`);
 	if (input.parseFallbacks && input.parseFallbacks > 0) reasons.add(`parse-fallbacks:${input.parseFallbacks}`);
+	if (input.astFallbackFiles && input.astFallbackFiles > 0) reasons.add(`ast-budget-fallback-files:${input.astFallbackFiles}`);
 	if (input.scopeDegraded) reasons.add(`scope-degraded:${input.scopeDegraded}`);
 	if (input.runtimeIncomplete) reasons.add("runtime-incomplete");
 	if (input.identityIncomplete) reasons.add("identity-incomplete");
 	for (const reason of truncationReasons) reasons.add(`truncated:${reason}`);
+	for (const entry of degradations) reasons.add(`degraded:${entry.reason}:${entry.count}`);
 	const discoveryPartial = input.discoveryTruncated || input.scopeIgnored > 0 || input.scopeUnrecognized > 0 || input.scopeDegraded !== void 0;
 	const rulesPartial = input.rulesPartial || input.rulesCrashed > 0 || input.parseFailed > 0;
 	return {
-		partial: discoveryPartial || rulesPartial || input.skippedFiles > 0 || input.runtimeIncomplete === true || input.identityIncomplete === true || truncationReasons.length > 0,
+		partial: discoveryPartial || rulesPartial || input.skippedFiles > 0 || input.runtimeIncomplete === true || input.identityIncomplete === true || truncationReasons.length > 0 || degradations.length > 0,
 		analysisStatus: {
 			discovery: discoveryPartial ? "partial" : "complete",
 			rules: rulesPartial ? "partial" : "complete",
@@ -150,11 +153,49 @@ function deriveCompletion(input) {
 			rulesCrashed: input.rulesCrashed,
 			parseFallbacks: input.parseFallbacks ?? 0,
 			...truncationReasons.length > 0 ? { truncationReasons } : {},
+			...degradations.length > 0 ? { degradations } : {},
 			reasons: [...reasons].sort()
 		}
 	};
 }
 //#endregion
+//#region src/engine/degradation-ledger.ts
+/**
+* Append-only. Records are never edited and never removed by a recording
+* site; a reader takes a window, and the window is defined by index, so
+* "delete my entry" is not an operation this module offers.
+*/
+const records = [];
+/** Record one capability loss. `count` is for a site that fails N at once. */
+function recordDegradation(reason, count = 1) {
+	if (!Number.isInteger(count) || count < 1) return;
+	for (let index = 0; index < count; index++) records.push({ reason });
+}
+/**
+* Mark where this reader's window opens. Everything appended from here on is
+* what the reader will see; see the file header for what a concurrent scan
+* does to that boundary.
+*/
+function beginDegradationWindow() {
+	return records.length;
+}
+/** The records appended since `marker`, without consuming them. */
+function degradationsSince(marker) {
+	return records.slice(marker);
+}
+/**
+* Per-reason counts for a window, sorted by reason so the output is
+* byte-deterministic for the same set of degradations.
+*/
+function summarizeDegradations(window) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const record of window) counts.set(record.reason, (counts.get(record.reason) ?? 0) + 1);
+	return [...counts.entries()].map(([reason, count]) => ({
+		reason,
+		count
+	})).sort((a, b) => a.reason < b.reason ? -1 : a.reason > b.reason ? 1 : 0);
+}
+//#endregion
 //#region src/engine/runtime-corroboration.ts
 /**
 * Stamp runtime corroboration + trust levels onto findings (mutates in
@@ -1105,6 +1146,120 @@ function createExecutor(name, concurrency, runOne) {
 	};
 }
 //#endregion
+//#region src/scope/git-resolve.ts
+/**
+* Absolute-path git resolution (audit S1).
+*
+* `execFileSync("git", …)` resolves through PATH — including the CWD on
+* Windows (CreateProcess searches the current directory before PATH for
+* extension-less names depending on NoDefaultCurrentDirectoryInExePath).
+* Scanning an UNTRUSTED repo therefore let a checked-in `git.exe` (or
+* `git.bat`/`git.cmd`) hijack Mjölnir's own git invocations: the attacker
+* controls the diff output, the merge-base decision, and
+* `--scope changed`'s "what is new" answer — the exact data CI gates on.
+*
+* The fix: resolve git ONCE per process to an ABSOLUTE path by walking
+* the PATH directly (never consulting the CWD), verify the candidate is
+* an existing file, and pass that path to execFileSync. Resolution is
+* memoized; a failure to find a real git anywhere on PATH is recorded
+* and callers degrade without invoking a bare name.
+*/
+let resolvedGit = void 0;
+/**
+* The absolute path of the git binary Mjölnir will invoke, or null when
+* PATH carries no executable `git` at all. Callers must degrade without
+* invoking a bare name.
+*/
+function resolveGitPath() {
+	if (resolvedGit !== void 0) return resolvedGit;
+	const candidates = [process.platform === "win32" ? "git.exe" : "git"];
+	if (process.platform === "win32") {
+		const pathExt = process.env["PATHEXT"]?.split(";").filter(Boolean) ?? [];
+		for (const ext of pathExt) candidates.push(`git${ext.toLowerCase()}`);
+	}
+	const pathValue = process.env["PATH"] ?? "";
+	for (const dir of pathValue.split(delimiter)) {
+		if (dir === "") continue;
+		if (!isAbsolute(dir)) continue;
+		for (const candidate of candidates) {
+			const full = join(dir, candidate);
+			try {
+				if (existsSync(full)) {
+					resolvedGit = full;
+					return resolvedGit;
+				}
+			} catch {}
+		}
+	}
+	`${pathValue.length}`;
+	resolvedGit = null;
+	return resolvedGit;
+}
+/**
+* Run git with the S1-resolved absolute binary path. Returns stdout, or
+* null when git is missing or the command fails — the same contract as
+* the previous inline `git()` helpers, with the hijack surface closed.
+*/
+function runGit(root, args) {
+	const exe = resolveGitPath();
+	if (!exe) return null;
+	try {
+		return execFileSync(exe, [
+			"-C",
+			root,
+			...args
+		], {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			timeout: 15e3
+		});
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/lib/safe-json.ts
+/**
+* Reusable safe-JSON parse-and-validate helper.
+*
+* Replaces the `JSON.parse(text) as T` pattern with a two-step process:
+*   1. Try/catch around JSON.parse (descriptive error on bad JSON)
+*   2. Runtime validation of the parsed shape (caller-supplied predicate)
+*
+* The `validate` predicate is intentionally lightweight — it checks the
+* expected shape exists rather than exhaustively type-guarding every field.
+* Internal files (cache, hashes) use `isRecord`; user-facing files
+* (config, plugins) use stricter checks that throw descriptive errors.
+*/
+const MAX_JSON_BYTES = 16777216;
+function parseJsonFile(text, source, validate) {
+	if (Buffer.byteLength(text, "utf8") > MAX_JSON_BYTES) throw new Error(`JSON source exceeds the ${MAX_JSON_BYTES}-byte limit: ${source}`);
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch (err) {
+		throw new Error(`invalid JSON in ${source}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+	}
+	if (!validate(parsed)) throw new Error(`unexpected shape in ${source}`, { cause: parsed });
+	return parsed;
+}
+/**
+* Minimal validator: value is a plain object (not null, not array).
+* Sufficient for internal files (cache, hashes) where downstream
+* code already checks individual fields.
+*/
+function isRecord(v) {
+	try {
+		return typeof v === "object" && v !== null && !Array.isArray(v);
+	} catch {
+		return false;
+	}
+}
+//#endregion
 //#region src/engine/candidate-binding.ts
 /**
 * Candidate binding (plan V5-010).
@@ -1125,9 +1280,6 @@ const SHA40 = /^[a-f0-9]{40}$/;
 const SHA256 = /^[a-f0-9]{64}$/;
 const STATES = ["WORKING_CANDIDATE", "RELEASE_CANDIDATE"];
 const AUTHORIZATION = ["NOT_AUTHORIZED", "AUTHORIZED"];
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function sha256File(path) {
 	try {
 		return createHash("sha256").update(readFileSync(path)).digest("hex");
@@ -1135,17 +1287,41 @@ function sha256File(path) {
 		return;
 	}
 }
+/**
+* One git line, or nothing.
+*
+* Audit S1: the binary is the ABSOLUTE path `resolveGitPath()` found by
+* walking PATH itself, never the bare name. `bindRepository()` runs on every
+* scan (`scan-pipeline.ts`), and a bare `execFileSync("git", …)` lets a
+* `git.exe`/`git.bat`/`git.cmd` CHECKED INTO AN UNTRUSTED REPO hijack the
+* call on Windows, where CreateProcess searches the current directory before
+* PATH. The attacker then controls the `commit` and `tree` that land in
+* `runIdentity` and the evidence graph — the provenance a release decision
+* reads. This was the last bare-name exec left in `src/`; the invariant that
+* keeps it that way is `tests/contract/no-bare-process-exec.spec.ts`.
+*
+* The `-C <root>` shape (not `cwd`) matches every other hardened call site.
+* With no git on PATH at all, the answer is nothing — a scan of an unpacked
+* tarball has no commit, and its identity must say so rather than carrying a
+* placeholder that looks like provenance.
+*/
 function gitLine(root, args) {
+	const exe = resolveGitPath();
+	if (!exe) return void 0;
 	try {
-		const trimmed = execFileSync("git", args, {
-			cwd: root,
+		const trimmed = execFileSync(exe, [
+			"-C",
+			root,
+			...args
+		], {
 			encoding: "utf8",
 			stdio: [
 				"ignore",
 				"pipe",
 				"ignore"
 			],
-			windowsHide: true
+			windowsHide: true,
+			timeout: 15e3
 		}).trim();
 		return trimmed.length > 0 ? trimmed : void 0;
 	} catch {
@@ -1176,9 +1352,9 @@ function bindRepository(root) {
 * contradiction the release decision evaluator treats as BLOCKED).
 */
 function parseCandidateBinding(raw) {
-	if (!isRecord$1(raw)) return null;
+	if (!isRecord(raw)) return null;
 	const identity = raw.identity;
-	if (!isRecord$1(identity)) return null;
+	if (!isRecord(identity)) return null;
 	const state = identity.state;
 	const candidateSha = identity.candidateSha;
 	const baseSha = identity.baseSha;
@@ -1227,7 +1403,7 @@ function readCandidateBinding(root, manifestPath = CANDIDATE_MANIFEST_PATH) {
 * scripts/sync-sarif-version.cjs and guarded by the version-consistency
 * spec. cli.ts re-exports this as CLI_VERSION.
 */
-const ENGINE_VERSION = "4.0.0";
+const ENGINE_VERSION = "5.0.0";
 //#endregion
 //#region src/engine/contract-versions.ts
 /**
@@ -1356,9 +1532,12 @@ function discoverWorkspace(rootDir) {
 	const root = findProjectRoot(rootDir);
 	if (!root) return null;
 	let pkg = {};
-	try {
-		pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
-	} catch {}
+	const manifestPath = join(root, "package.json");
+	if (existsSync(manifestPath)) try {
+		pkg = JSON.parse(readFileSync(manifestPath, "utf8"));
+	} catch {
+		recordDegradation("workspace-manifest-unreadable");
+	}
 	const rawWorkspaces = pkg["workspaces"];
 	let globs = [];
 	if (Array.isArray(rawWorkspaces)) globs = rawWorkspaces.filter((w) => typeof w === "string");
@@ -1375,40 +1554,6 @@ function basename$1(p) {
 	return parts[parts.length - 1];
 }
 //#endregion
-//#region src/lib/safe-json.ts
-/**
-* Reusable safe-JSON parse-and-validate helper.
-*
-* Replaces the `JSON.parse(text) as T` pattern with a two-step process:
-*   1. Try/catch around JSON.parse (descriptive error on bad JSON)
-*   2. Runtime validation of the parsed shape (caller-supplied predicate)
-*
-* The `validate` predicate is intentionally lightweight — it checks the
-* expected shape exists rather than exhaustively type-guarding every field.
-* Internal files (cache, hashes) use `isRecord`; user-facing files
-* (config, plugins) use stricter checks that throw descriptive errors.
-*/
-const MAX_JSON_BYTES = 16777216;
-function parseJsonFile(text, source, validate) {
-	if (Buffer.byteLength(text, "utf8") > MAX_JSON_BYTES) throw new Error(`JSON source exceeds the ${MAX_JSON_BYTES}-byte limit: ${source}`);
-	let parsed;
-	try {
-		parsed = JSON.parse(text);
-	} catch (err) {
-		throw new Error(`invalid JSON in ${source}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
-	}
-	if (!validate(parsed)) throw new Error(`unexpected shape in ${source}`, { cause: parsed });
-	return parsed;
-}
-/**
-* Minimal validator: value is a plain object (not null, not array).
-* Sufficient for internal files (cache, hashes) where downstream
-* code already checks individual fields.
-*/
-function isRecord(v) {
-	return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-//#endregion
 //#region src/lib/fs-bounded.ts
 function closeQuiet(fd) {
 	try {
@@ -1638,6 +1783,12 @@ function validate(cfg, knownRuleIds) {
 * Expiry is evaluated only from an explicit ISO `expires` date. A missing
 * date remains active and is reported as having no expiry. Config-file mtime
 * is never an expiry anchor.
+*
+* `now` defaults to the current instant so existing callers stay correct, but
+* a verdict function that reads the clock invisibly is a verdict nobody can
+* test at a boundary. `tests/contract/deterministic-clock.spec.ts` audits
+* `src/config/**` for a call site that supplies its own `new Date()` instead
+* of threading one through.
 */
 function isSuppressionActive(ign, now = /* @__PURE__ */ new Date()) {
 	if (!ign.expires) return true;
@@ -2038,6 +2189,7 @@ function parseTsFile(file) {
 		}
 		return p.createSourceFile(file.path, file.text);
 	} catch {
+		recordDegradation("ast-parse-failed");
 		return;
 	}
 }
@@ -2093,6 +2245,7 @@ function commentAndStringRanges(ctx) {
 		}
 		return ranges;
 	} catch {
+		recordDegradation("ast-range-scan-failed");
 		return [];
 	}
 }
@@ -2140,6 +2293,7 @@ function getCodeOnlyText(file) {
 		for (const r of ranges) for (let i = r.start; i < r.end && i < chars.length; i++) if (chars[i] !== "\n" && chars[i] !== "\r") chars[i] = " ";
 		return chars.join("");
 	} catch {
+		recordDegradation("ast-mask-unavailable");
 		return file.text;
 	}
 }
@@ -2524,6 +2678,44 @@ function frameworkFilterApplies(rule, file) {
 	return rule.frameworks.some((f) => tags.includes(f));
 }
 //#endregion
+//#region src/engine/shared-run-rules.ts
+/**
+* Run ONE rule with crash isolation, and return what it produced.
+*
+* This is the block that was copy-pasted into all seven language adapters:
+*
+*   try { for (const f of rule.run(x)) emit(f, rule.id, rule.category); }
+*   catch (error) { onCrash?.(rule.id, error); }
+*
+* Extracting it is worth doing for one reason beyond line count. Crash
+* isolation is the mechanism that lets a third-party or experimental
+* detector fail without ending a scan, and it is the mechanism the whole
+* `rulesCrashed` count depends on. Seven copies means seven chances to
+* write `catch {}` and lose the count, and `tests/contract/
+* no-uncounted-degradation.spec.ts` can only audit what it can see.
+*
+* `null` means the rule CRASHED, which is not the same as an empty array:
+* an empty array is the rule abstaining, and the adapters skip emission for
+* both but the distinction is why the caller must not conflate them.
+*
+* Deliberately NOT extracted: the per-adapter filter chain and the budget
+* check. Those genuinely differ — the TypeScript adapter injects an AST,
+* framework tags, a lazy `codeText` getter, `appliesTo` scoping, config-only
+* gating and `configGateMatches`, and it ABORTS the whole file on budget
+* exhaustion where `runRulesShared` only `continue`s to the next rule.
+* Routing every adapter through `runRulesShared` as written would silently
+* change which rules run and when, which is precisely the unmeasured claim
+* this program exists to delete. This helper takes the part they share.
+*/
+function runRuleIsolated(rule, file, onCrash) {
+	try {
+		return rule.run(file);
+	} catch (error) {
+		onCrash?.(rule.id, error);
+		return null;
+	}
+}
+//#endregion
 //#region src/adapters/typescript.ts
 /**
 * TypeScript/JavaScript adapter (R1).
@@ -2733,11 +2925,9 @@ const typescriptAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run(enriched)) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, enriched, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -2765,6 +2955,7 @@ function loadWorkspaceShim(root) {
 			workspaceGlobs: []
 		};
 	} catch {
+		recordDegradation("workspace-manifest-unreadable");
 		return null;
 	}
 }
@@ -3119,11 +3310,9 @@ const pythonAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run(enriched)) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, enriched, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	},
 	async parseAst(file) {
@@ -3276,11 +3465,9 @@ const javaAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run(enriched)) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, enriched, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -3434,11 +3621,9 @@ const csharpAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run(enriched)) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, enriched, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -3616,6 +3801,7 @@ const githubActionsAdapter = {
 		try {
 			entries = readdirSync(wfDir);
 		} catch {
+			recordDegradation("ci-workflow-listing-unreadable");
 			return;
 		}
 		for (const name of entries) {
@@ -3656,15 +3842,13 @@ const githubActionsAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run({
-					path: file.path,
-					text: file.text,
-					ast: doc
-				})) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, {
+				path: file.path,
+				text: file.text,
+				ast: doc
+			}, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -3974,15 +4158,13 @@ const azurePipelinesAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run({
-					path: file.path,
-					text: file.text,
-					ast: doc
-				})) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, {
+				path: file.path,
+				text: file.text,
+				ast: doc
+			}, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -4053,14 +4235,12 @@ const jenkinsAdapter = {
 				budget.onExceeded();
 				return;
 			}
-			try {
-				for (const f of rule.run({
-					path: file.path,
-					text: file.text
-				})) emit(f, rule.id, rule.category);
-			} catch (error) {
-				onCrash?.(rule.id, error);
-			}
+			const produced = runRuleIsolated(rule, {
+				path: file.path,
+				text: file.text
+			}, onCrash);
+			if (produced === null) continue;
+			for (const f of produced) emit(f, rule.id, rule.category);
 		}
 	}
 };
@@ -4224,82 +4404,6 @@ const SEARCHED_FOR = [
 	}
 ];
 //#endregion
-//#region src/scope/git-resolve.ts
-/**
-* Absolute-path git resolution (audit S1).
-*
-* `execFileSync("git", …)` resolves through PATH — including the CWD on
-* Windows (CreateProcess searches the current directory before PATH for
-* extension-less names depending on NoDefaultCurrentDirectoryInExePath).
-* Scanning an UNTRUSTED repo therefore let a checked-in `git.exe` (or
-* `git.bat`/`git.cmd`) hijack Mjölnir's own git invocations: the attacker
-* controls the diff output, the merge-base decision, and
-* `--scope changed`'s "what is new" answer — the exact data CI gates on.
-*
-* The fix: resolve git ONCE per process to an ABSOLUTE path by walking
-* the PATH directly (never consulting the CWD), verify the candidate is
-* an existing file, and pass that path to execFileSync. Resolution is
-* memoized; a failure to find a real git anywhere on PATH is recorded
-* and callers degrade without invoking a bare name.
-*/
-let resolvedGit = void 0;
-/**
-* The absolute path of the git binary Mjölnir will invoke, or null when
-* PATH carries no executable `git` at all. Callers must degrade without
-* invoking a bare name.
-*/
-function resolveGitPath() {
-	if (resolvedGit !== void 0) return resolvedGit;
-	const candidates = [process.platform === "win32" ? "git.exe" : "git"];
-	if (process.platform === "win32") {
-		const pathExt = process.env["PATHEXT"]?.split(";").filter(Boolean) ?? [];
-		for (const ext of pathExt) candidates.push(`git${ext.toLowerCase()}`);
-	}
-	const pathValue = process.env["PATH"] ?? "";
-	for (const dir of pathValue.split(delimiter)) {
-		if (dir === "") continue;
-		if (!isAbsolute(dir)) continue;
-		for (const candidate of candidates) {
-			const full = join(dir, candidate);
-			try {
-				if (existsSync(full)) {
-					resolvedGit = full;
-					return resolvedGit;
-				}
-			} catch {}
-		}
-	}
-	`${pathValue.length}`;
-	resolvedGit = null;
-	return resolvedGit;
-}
-/**
-* Run git with the S1-resolved absolute binary path. Returns stdout, or
-* null when git is missing or the command fails — the same contract as
-* the previous inline `git()` helpers, with the hijack surface closed.
-*/
-function runGit(root, args) {
-	const exe = resolveGitPath();
-	if (!exe) return null;
-	try {
-		return execFileSync(exe, [
-			"-C",
-			root,
-			...args
-		], {
-			encoding: "utf8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			],
-			timeout: 15e3
-		});
-	} catch {
-		return null;
-	}
-}
-//#endregion
 //#region src/scope/changed.ts
 /**
 * Changed-scope engine (Sprint-Plan W6, Product-MVP §9 `--scope changed`).
@@ -11781,6 +11885,53 @@ const RETIRED_RULE_IDS = [
 	"QA-CS-111"
 ];
 //#endregion
+//#region src/lib/compare.ts
+/**
+* Order that does not depend on who is asking.
+*
+* `String.prototype.localeCompare` with no locale argument resolves against
+* the PROCESS's default locale — the ICU collation chosen by `LANG`,
+* `LC_ALL` or the OS. So a sort written as
+* `[...xs].sort((a, b) => a.localeCompare(b))` produces a different order on
+* a developer's `de_DE` machine than on an en-US CI runner. For a display
+* list that is a nuisance; for anything that reaches a hash, a cache key, a
+* digest or a machine contract it is a correctness bug, because the same
+* repository then produces two different fingerprints.
+*
+* Two comparators, one per kind of site:
+*
+*   compareCodePoints — pure UTF-16 code-unit order. Identical everywhere,
+*   independent of ICU version, and already what `Array.prototype.sort`
+*   defaults to. Use for every value that reaches a fingerprint, a digest,
+*   a cache key, or a contract, and for any ordering with no human-facing
+*   reason to be pretty.
+*
+*   compareLocalized(locale) — the same collator, PINNED to a named locale
+*   instead of inheriting the environment, for a surface that genuinely
+*   wants readable order (a table of rule titles, a Mermaid legend). Pinned
+*   rather than removed because a reader-facing list of "Test / Logic /
+*   Mock" should not be ordered by code unit.
+*
+* A bare `localeCompare` with no second argument in `src/` is a defect and
+* `tests/contract/deterministic-ordering.spec.ts` fails the build on it.
+*/
+/** Code-unit order. Locale-free, ICU-free, and the Array.sort default. */
+function compareCodePoints(a, b) {
+	if (a === b) return 0;
+	return a < b ? -1 : 1;
+}
+/**
+* A readable-order comparator pinned to `locale`.
+*
+* The pin is the point: `a.localeCompare(b)` reads the environment, and the
+* environment is a machine setting, not a property of the code. Callers that
+* want stable output ask for a named locale and get the same answer on every
+* machine that ships the same ICU data.
+*/
+function compareLocalized(locale) {
+	return (a, b) => a.localeCompare(b, locale);
+}
+//#endregion
 //#region src/scorer/scorer.ts
 /**
 * Transparent scorer (Product-MVP §8).
@@ -11837,7 +11988,7 @@ function computeDimensions(findings) {
 		deductions.set(f.category, deductions.get(f.category) + deductionFor(f));
 	}
 	for (const dim of byCategory.values()) dim.score = Math.max(0, 100 - deductions.get(dim.category));
-	return [...byCategory.values()].sort((a, b) => a.category.localeCompare(b.category));
+	return [...byCategory.values()].sort((a, b) => compareCodePoints(a.category, b.category));
 }
 /**
 * Deduction-mass ceilings (product-gap-remediation master plan P2,
@@ -12279,7 +12430,7 @@ function groupByRootCause(findings) {
 function correlateFindings(findings) {
 	const conclusions = [];
 	const rootCauseGroups = groupByRootCause(findings);
-	for (const [rootCause, group] of Array.from(rootCauseGroups.entries()).sort((a, b) => a[0].localeCompare(b[0]))) {
+	for (const [rootCause, group] of Array.from(rootCauseGroups.entries()).sort((a, b) => compareLocalized("en")(a[0], b[0]))) {
 		if (group.length < 2) continue;
 		const findingIds = group.map((f) => f.findingId ?? f.ruleId);
 		conclusions.push({
@@ -12291,7 +12442,7 @@ function correlateFindings(findings) {
 		});
 	}
 	const fileGroups = groupByFile(findings);
-	for (const [file, group] of Array.from(fileGroups.entries()).sort((a, b) => a[0].localeCompare(b[0]))) {
+	for (const [file, group] of Array.from(fileGroups.entries()).sort((a, b) => compareCodePoints(a[0], b[0]))) {
 		if (group.length < 2) continue;
 		const alreadyConvergent = /* @__PURE__ */ new Set();
 		for (const c of conclusions) if (c.conclusionType === "CONVERGENT") for (const id of c.findingIds) alreadyConvergent.add(id);
@@ -13336,9 +13487,10 @@ function hashDir(dir, hash, depth) {
 	try {
 		entries = readdirSync(dir, { withFileTypes: true });
 	} catch {
+		recordDegradation("rules-tree-listing-unreadable");
 		return;
 	}
-	entries.sort((a, b) => a.name.localeCompare(b.name));
+	entries.sort((a, b) => compareCodePoints(a.name, b.name));
 	for (const entry of entries) {
 		if (entry.name === "node_modules" || entry.name === ".git") continue;
 		const full = join(dir, entry.name);
@@ -14916,11 +15068,11 @@ function listFiles(dir) {
 * `mjolnir suppressions` — every suppression stays visible.
 */
 const ui = plainContext();
-function loadSuppressions(root) {
+function loadSuppressions(root, now = /* @__PURE__ */ new Date()) {
 	const { config } = loadConfig(root);
 	const entries = (config.ignore ?? []).map((ign) => ({
 		...ign,
-		status: isSuppressionActive(ign, /* @__PURE__ */ new Date()) ? "active" : "expired"
+		status: isSuppressionActive(ign, now) ? "active" : "expired"
 	}));
 	return {
 		total: entries.length,
@@ -15689,6 +15841,7 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 	let rulesPartial = false;
 	let parseFailed = 0;
 	let parseFallbacks = 0;
+	let astFallbackFiles = 0;
 	let scanned = 0;
 	let analyzed = 0;
 	for (const path of testFiles) {
@@ -15732,6 +15885,10 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 			});
 		}
 		const wantsAst = adapter.parseAst !== void 0 && Date.now() <= deadline;
+		if (adapter.parseAst !== void 0 && !wantsAst) {
+			truncationReasons.add("ast-budget-fallback");
+			astFallbackFiles++;
+		}
 		const identity = (mode) => ({
 			relPath,
 			adapterId: adapter.id,
@@ -15849,7 +16006,8 @@ async function runFileAnalysisPhase(findings, testFiles, workspace, activeRules,
 		parseFailed,
 		parseFallbacks,
 		scanned,
-		analyzed
+		analyzed,
+		astFallbackFiles
 	};
 }
 /**
@@ -16077,6 +16235,8 @@ function assembleScanResult(o) {
 		scopeUnrecognized: o.scopeUnrecognized,
 		parseFailed: o.parseFailed,
 		parseFallbacks: o.parseFallbacks ?? 0,
+		...o.astFallbackFiles !== void 0 ? { astFallbackFiles: o.astFallbackFiles } : {},
+		...o.degradations !== void 0 ? { degradations: o.degradations } : {},
 		...o.scopeInfo.degraded !== void 0 ? { scopeDegraded: o.scopeInfo.degraded } : {},
 		...o.runtimeIncomplete !== void 0 ? { runtimeIncomplete: o.runtimeIncomplete } : {},
 		identityIncomplete
@@ -16195,13 +16355,15 @@ function assembleScanResult(o) {
 */
 async function runScan(args, hooks = {}) {
 	const started = Date.now();
+	const degradationWindow = beginDegradationWindow();
 	const requestedDuration = Number.isFinite(args.maxDurationMs) ? args.maxDurationMs : DEFAULT_MAX_DURATION_MS;
 	const deadline = started + Math.min(Math.max(1, requestedDuration), MAX_DURATION_MS);
 	const discovered = discoverWorkspace(args.target);
 	const targetAbs = resolve(args.target);
 	const scanRoot = discovered && discovered.root !== targetAbs && targetAbs.startsWith(discovered.root + sep) ? {
 		...discovered,
-		root: targetAbs
+		root: targetAbs,
+		packageJson: {}
 	} : discovered ?? fallbackWorkspace(targetAbs);
 	const workspace = scanRoot;
 	if (args.verbose) hooks.onConfigWarning?.(`verbose: scan root (config/ignore anchor): ${workspace.root}`);
@@ -16286,6 +16448,7 @@ async function runScan(args, hooks = {}) {
 	rulesPartial = analysis.rulesPartial;
 	parseFailed = analysis.parseFailed;
 	const parseFallbacks = analysis.parseFallbacks;
+	const astFallbackFiles = analysis.astFallbackFiles;
 	const scanned = analysis.scanned;
 	const analyzed = analysis.analyzed;
 	const postScan = applyPostScanProcessing(findings, workspace, args, hooks, scanRoot, declarationsByFile, testDeclarationCount, tierByRuleId, REVISION_BY_RULE_ID);
@@ -16304,6 +16467,8 @@ async function runScan(args, hooks = {}) {
 		scopeUnrecognized,
 		parseFailed,
 		parseFallbacks,
+		astFallbackFiles,
+		degradations: summarizeDegradations(degradationsSince(degradationWindow)),
 		scanned,
 		analyzed,
 		testFiles,
@@ -16331,6 +16496,6 @@ async function runScan(args, hooks = {}) {
 	return result;
 }
 //#endregion
-export { BADGE_BAND as $, plainContext as A, isLintFixtureDir as At, shouldUseAscii as B, DEDUCTIONS as Bt, runForensics as C, computeCodeText as Ct, nextStep as D, LIMITS$1 as Dt, buildFooter as E, DEFAULT_IGNORE_MATCHER as Et, padTo as F, isRecord as Ft, countOrNull as G, deriveEvidenceLevel as Gt, atomicTempPath as H, RULE_CATEGORIES as Ht, palette as I, parseJsonFile as It, evidenceTag as J, deriveScoreState as K, isAdvisoryFinding as Kt, sanitizeData as L, ENGINE_VERSION as Lt, severityIcon as M, isSuppressionActive as Mt, box as N, loadConfig as Nt, okIcon as O, createIgnoreMatcher as Ot, measure as P, readFileBounded as Pt, TRUST_RUNGS as Q, scoreGauge as R, buildEvidenceGraph as Rt, renderSuppressions as S, parseYamlGuarded as St, FLAKE_GLYPH as T, detectFrameworks as Tt, sweepStaleTempFiles as U, SEVERITY_ORDER as Ut, wrapText as V, QA_IMPACT_LABELS as Vt, writeFileAtomic as W, TRUST_ORDER as Wt, testsAnalyzedCell as X, headlineFor as Y, verdictFor as Z, summarizeForensicVerdicts as _, SCAN_ADAPTERS as _t, applyPostScanProcessing as a, correlateFindings as at, loadLocalRules as b, parseAzurePipeline as bt, discoverAndParseRuntimeReport as c, capForTier as ct, isValidFindingRecord as d, massCeiling as dt, SCORE as et, pathMatchesGlob as f, RETIRED_RULE_IDS as ft, selectAdapter as g, runGit as gt, scan_pipeline_exports as h, resolveGitPath as ht, SUITE_INVALIDATING_RULE_IDS as i, getReachableFiles as it, sectionHeader as j, ConfigValidationError as jt, panel as k, globToRegExp as kt, discoverTestFilesPhase as l, computeDimensions as lt, runScan as m, getRule as mt, KNOWN_RULE_IDS as n, TINT as nt, assembleScanResult as o, classifyProvenance as ot, runFileAnalysisPhase as p, RULES as pt, evidenceLevelOf as q, isValidCategory as qt, OVERLAP_META_BY_RULE_ID as r, buildDependencyGraph as rt, buildUniversalRules as s, computeAgenticProfile as st, EVIDENCE_OVERRIDES as t, STATUS as tt, fallbackWorkspace as u, deductionFor as ut, pluginsGateOpen as v, SEARCHED_FOR as vt, sanitizeErrorText as w, parseTsFile as wt, loadSuppressions as x, parseWorkflow as xt, renderGateNotice as y, isAzurePipelineFixture as yt, shouldColorize as z, MEASURED_FP as zt };
+export { BADGE_BAND as $, plainContext as A, ConfigValidationError as At, shouldUseAscii as B, MEASURED_FP as Bt, runForensics as C, parseTsFile as Ct, nextStep as D, createIgnoreMatcher as Dt, buildFooter as E, LIMITS$1 as Et, padTo as F, isRecord as Ft, countOrNull as G, DEDUCTIONS as Gt, atomicTempPath as H, degradationsSince as Ht, palette as I, parseJsonFile as It, evidenceTag as J, SEVERITY_ORDER as Jt, deriveScoreState as K, QA_IMPACT_LABELS as Kt, sanitizeData as L, resolveGitPath as Lt, severityIcon as M, loadConfig as Mt, box as N, readFileBounded as Nt, okIcon as O, globToRegExp as Ot, measure as P, ENGINE_VERSION as Pt, TRUST_RUNGS as Q, isValidCategory as Qt, scoreGauge as R, runGit as Rt, renderSuppressions as S, computeCodeText as St, FLAKE_GLYPH as T, DEFAULT_IGNORE_MATCHER as Tt, sweepStaleTempFiles as U, recordDegradation as Ut, wrapText as V, beginDegradationWindow as Vt, writeFileAtomic as W, summarizeDegradations as Wt, testsAnalyzedCell as X, deriveEvidenceLevel as Xt, headlineFor as Y, TRUST_ORDER as Yt, verdictFor as Z, isAdvisoryFinding as Zt, summarizeForensicVerdicts as _, SEARCHED_FOR as _t, applyPostScanProcessing as a, correlateFindings as at, loadLocalRules as b, parseWorkflow as bt, discoverAndParseRuntimeReport as c, capForTier as ct, isValidFindingRecord as d, massCeiling as dt, SCORE as et, pathMatchesGlob as f, compareCodePoints as ft, selectAdapter as g, SCAN_ADAPTERS as gt, scan_pipeline_exports as h, getRule as ht, SUITE_INVALIDATING_RULE_IDS as i, getReachableFiles as it, sectionHeader as j, isSuppressionActive as jt, panel as k, isLintFixtureDir as kt, discoverTestFilesPhase as l, computeDimensions as lt, runScan as m, RULES as mt, KNOWN_RULE_IDS as n, TINT as nt, assembleScanResult as o, classifyProvenance as ot, runFileAnalysisPhase as p, RETIRED_RULE_IDS as pt, evidenceLevelOf as q, RULE_CATEGORIES as qt, OVERLAP_META_BY_RULE_ID as r, buildDependencyGraph as rt, buildUniversalRules as s, computeAgenticProfile as st, EVIDENCE_OVERRIDES as t, STATUS as tt, fallbackWorkspace as u, deductionFor as ut, pluginsGateOpen as v, isAzurePipelineFixture as vt, sanitizeErrorText as w, detectFrameworks as wt, loadSuppressions as x, parseYamlGuarded as xt, renderGateNotice as y, parseAzurePipeline as yt, shouldColorize as z, buildEvidenceGraph as zt };
 
-//# sourceMappingURL=scan-pipeline-CCJdEKNa.mjs.map
+//# sourceMappingURL=scan-pipeline-DT8DWAMl.mjs.map