mjolnir-qa 6.0.1 → 6.1.0

package/CHANGELOG.md

@@ -11,6 +11,130 @@ once shipped, so this file is the record of what changed between versions.
 
 ## [Unreleased]
 
+## [6.1.0] — 2026-10-28
+
+A minor release from the second half of the maintenance review. Most of it
+fixes behaviour that was wrong without saying so: report text that rendered as
+escaped markup, warnings that printed twice or not at all, reads that failed
+and were counted as successes, and release workflows that could publish when
+told not to. No verb, flag, Action input or MCP tool was added or removed.
+
+### Upgrade notes
+
+Two config checks are now strict and exit 10 with the entry named. Both
+configurations used to load and then silently do nothing, so a config that
+fails here was already not doing what it said.
+
+- `ignore[].expires` must be a calendar date, `YYYY-MM-DD`. A date-time
+  (`2026-09-01T00:00:00Z`) or an unpadded date (`2026-9-1`) left the
+  suppression inactive; write the date alone.
+- `plugins` must be an array of package names or `{ "package": "…" }`
+  objects. An object such as `{ "acme": {} }` loaded no plugin; write
+  `["acme"]`.
+
+### Fixed: the scheduled OSV scan runs again
+
+- **OSV-Scanner 2.7.0 removed `--skip-git`**, so the push and scheduled scans
+  failed before scanning. The flag is gone; pull-request scans never passed it.
+
+### Fixed: flag suggestions name only flags that exist
+
+- **`mjolnir scan` suggests only flags it accepts.** `--dry-run` and
+  `--version` were offered as "Did you mean" right after being rejected, and
+  ten accepted flags (`--staged`, `--blocking`, `--enable-plugins`, …) were
+  never suggested. A spec now reads the parser to hold the two lists together.
+- **Dead code removed:** the `ci install` line that shadowed the `ci`
+  subcommand table, an unreachable `ci --help` arm, an `existsSync` given a
+  glob it cannot expand, and two copies of the scan time-budget constants,
+  which the CLI and the MCP server now import from the pipeline that applies
+  them.
+
+### Fixed: CI and release workflows
+
+- **A stable release publishes to `latest` directly** (`release.yml`). It
+  published to `next` and relied on a token-based repair to move `latest`.
+- **A stable-release resume honours `dry_run` and requires
+  `STABLE_RELEASE_AUTHORIZED`.** It ignored both, so a resume dispatched with
+  the default `dry_run: true` published, including a dry run's artifact.
+- **The npm propagation wait polls `latest` as well as the version, for up to
+  ten minutes, and fails by name.** 6.0.1 took over five minutes to appear,
+  and the job timed out.
+- **The Action major-tag workflow moves `vN` to the newest stable `vN.x.y`.**
+  A manual dispatch tagged the head of the dispatching branch, and an older
+  patch tag could move `vN` backwards.
+- **The dogfood PR comment posts only on same-repository pull requests.** On
+  a fork or a manual dispatch the job failed with 403.
+- `github.base_ref` reaches the shell through `env:` rather than script
+  interpolation. The dead badge step and a duplicate `check-version` call are
+  gone, and the nightly stress run no longer starts at the same minute as
+  fuzz.
+- **`ci install` treats a Dependabot action-pin bump as not a
+  customisation.** Only the Mjölnir Action's SHA was ignored, so each bump of
+  `actions/*` made every workflow the previous release generated read as
+  hand-edited. The template's pins follow `mjolnir.yml` again.
+- Action pins bumped: `setup-node` 7.1.0, `upload-artifact` 7.0.2,
+  `download-artifact` 8.0.2, CodeQL 4.39.1, OSV-Scanner 2.7.0, Scorecard
+  2.5.0. The `web-tree-sitter` 0.25.10 bump is not taken: the
+  `package-smoke` spec holds its exact 0.25.6 pin.
+
+### Fixed: report rendering, config validation and swallowed errors
+
+- **Paths and code-like fixes in the PR comment, step summary and handoff are
+  real code spans.** Backslash escapes are literal inside a code span, so
+  `__snapshots__` rendered as `\_\_snapshots\_\_`, and a backtick in a path
+  closed the span early. The fence is now longer than any backtick run inside.
+- **The INCOMPLETE banner on a complete scan with no runtime evidence says
+  so**, and the quarantine coverage note is written out in words. The banner
+  used to name "an unreported reason".
+- **`ignore[].expires` must be a calendar date, `YYYY-MM-DD` (exit 10
+  otherwise).** A date-time or `2026-9-1` loaded, then left the suppression
+  silently inactive with no expired warning, and `2026-02-30` quietly meant
+  March 2. The expired warning now uses the same check as
+  `mjolnir scan --suppressions`.
+- **`plugins` must be an array of package names or `{ "package": … }`
+  objects (exit 10 otherwise).** An object, or an entry of another shape,
+  loaded cleanly and the loader ran nothing.
+- **Config warnings print once.** `scan` printed each one twice, and `fix`,
+  `ci verify` and `handover` dropped them. Those three now also send the
+  plugin gate notice to their own stderr.
+- **MCP `explain` finds the rule's fixture from a checkout**, defaulting to
+  `<cwd>/tests/fixtures` as `mjolnir explain` does. It never returned the
+  example finding the CLI prints.
+- **Runtime corroboration matches Windows report paths whose case differs
+  from the scan root** (`c:\repo` and `C:\Repo`). Each verdict missed its
+  finding.
+- **`--changed` marks an unreadable untracked file as fully changed** instead
+  of building a million-entry line set for it, which also dropped any finding
+  past line 1,000,000.
+- **Swallowed reads are counted:** an unreadable `pom.xml`, `build.gradle` or
+  `.csproj` (`java-manifest-unreadable`, `csharp-project-unreadable`) and an
+  unreadable rule source file in the detector fingerprint
+  (`rules-tree-file-unreadable`). The evidence store's audit fails on an
+  unreadable records directory instead of reporting an empty, intact store,
+  and `forensics` says why `FLAKY.md` could not be written.
+- **Census version majors sort numerically without the ambient locale**, and
+  the deterministic-ordering contract now also catches a `localeCompare`
+  whose locale argument is `undefined`.
+
+### Fixed: the stable release publishes the artifact it verified
+
+- **The first 6.0.1 publish run pushed `v6.0.1` and moved `v6`, then failed
+  before `npm publish`.** The verified artifact holds `release-artifact/` and
+  `release-assets/`, so `upload-artifact` keeps both directories, and the
+  publish job downloaded it into `release-artifact`, one level too deep:
+  `sha256sum: release-artifact/mjolnir-qa-6.0.1.tgz: No such file or
+directory`. The GitHub-release job and both resume jobs read the same wrong
+  layout. All four now download into the workspace root, and a spec reads the
+  upload paths and holds every consumer to them.
+- **The resumed GitHub release attaches the release-trust record**, which the
+  first-attempt release already required.
+- **Both publish jobs read no `.npmrc`**, as `release.yml` does, so the
+  placeholder token `setup-node` writes there cannot stand in for OIDC trusted
+  publishing.
+- **The SBOM checksum records a relative path**, like the tarball's. It
+  recorded the runner's absolute workspace path, and checked out only because
+  every job ran on the same path.
+
 ## [6.0.1] — 2026-10-28
 
 A patch release. 6.0.0 shipped a GitHub Action whose report step calls a

package/README.md

@@ -19,7 +19,7 @@
 npx mjolnir-qa@latest
 ```
 
-Pin it for reproducible CI: `npx mjolnir-qa@6.0.1`. Requires **Node.js ≥ 22.18** on Windows, macOS or Linux.
+Pin it for reproducible CI: `npx mjolnir-qa@6.1.0`. Requires **Node.js ≥ 22.18** on Windows, macOS or Linux.
 
 [**Interactive walkthrough**](https://sergey-bar.github.io/Mjolnir/) · [Docs](https://sergey-bar.github.io/Mjolnir/) · [CHANGELOG](CHANGELOG.md) · [Video](assets/video/mjolnir-demo.mp4)
 
@@ -29,7 +29,7 @@ Pin it for reproducible CI: `npx mjolnir-qa@6.0.1`. Requires **Node.js ≥ 22.18
 
 ## Release status
 
-The published line is `6.0.1`, and this working tree is that line. The version table is
+The published line is `6.1.0`, and this working tree is that line. The version table is
 [`docs/ROADMAP.yaml`](docs/ROADMAP.yaml). This document does not publish a tag or authorize a release.
 
 ---
@@ -431,7 +431,7 @@ Every finding in a handoff carries its boundary: **E2** = deterministic, apply f
 
 ### Status
 
-**Version 6.0.1 published.** The JSON schema and the exit codes are frozen contracts. What comes next, with no invented dates:
+**Version 6.1.0 published.** The JSON schema and the exit codes are frozen contracts. What comes next, with no invented dates:
 [the public roadmap](https://sergey-bar.github.io/Mjolnir/reference/roadmap).
 
 ---

package/dist/cli.d.mts

@@ -1543,7 +1543,7 @@ declare function isValidFindingRecord$1(f: unknown): f is Omit<Finding, "ruleId"
  * without threading a Project through every adapter.
  */
 declare function runScan$1(args: CliArgs, hooks?: ScanHooks): Promise<ScanResult>;
-declare const ENGINE_VERSION = "6.0.1";
+declare const ENGINE_VERSION = "6.1.0";
 /**
  * Shared process IO sinks (certification-audit Phase 5, G6): the variadic
  * console sinks and the internal-error reporter lived in cli.ts, which
@@ -1753,7 +1753,7 @@ export declare function runTrustTrendCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-export declare const runScan: typeof runScan$1, buildUniversalRules: typeof buildUniversalRules$1, fallbackWorkspace: typeof fallbackWorkspace$1, pathMatchesGlob: typeof pathMatchesGlob$1, isValidFindingRecord: typeof isValidFindingRecord$1, discoverAndParseRuntimeReport: typeof discoverAndParseRuntimeReport$1, KNOWN_RULE_IDS: ReadonlySet<string>, OVERLAP_META_BY_RULE_ID: ReadonlyMap<string, OverlapMeta>, EVIDENCE_OVERRIDES: ReadonlyMap<string, string>, SUITE_INVALIDATING_RULE_IDS: ReadonlySet<string>;
+export declare const runScan: typeof runScan$1, buildUniversalRules: typeof buildUniversalRules$1, fallbackWorkspace: typeof fallbackWorkspace$1, pathMatchesGlob: typeof pathMatchesGlob$1, isValidFindingRecord: typeof isValidFindingRecord$1, discoverAndParseRuntimeReport: typeof discoverAndParseRuntimeReport$1, KNOWN_RULE_IDS: ReadonlySet<string>, OVERLAP_META_BY_RULE_ID: ReadonlyMap<string, OverlapMeta>, EVIDENCE_OVERRIDES: ReadonlyMap<string, string>, SUITE_INVALIDATING_RULE_IDS: ReadonlySet<string>, DEFAULT_MAX_DURATION_MS: number, MAX_DURATION_MS: number;
 /** A usage-error detail: the offending token, when one exists. */
 export interface UsageErrorDetail {
   /** The unknown flag or rejected value (e.g. `--nope`, `loud`). */
@@ -1761,9 +1761,17 @@ export interface UsageErrorDetail {
   /** The flag whose value was rejected (`--tone` for `--tone loud`). */
   flag?: string | undefined;
 }
-export declare const DEFAULT_MAX_DURATION_MS = 600000;
-export declare const MAX_DURATION_MS = 3600000;
 export declare function parseArgs(argv: string[], onError?: (detail: UsageErrorDetail) => void): CliArgs | null;
+/**
+ * Scan flags that exist — the "did you mean" candidate pool.
+ *
+ * Every flag `parseArgs` accepts, and nothing it rejects. The pool had
+ * drifted both ways: ten accepted flags were missing, and `--dry-run` and
+ * `--version` were in it although a scan rejects them, so `mjolnir scan
+ * --dry-run` answered `unknown flag "--dry-run"` and then suggested it.
+ * tests/cli/help.spec.ts reads `parseArgs` to hold the two lists together.
+ */
+export declare const KNOWN_SCAN_FLAGS: string[];
 /** Hand-rolled Levenshtein distance (plan M2: no new dependencies). */
 export declare function levenshtein(a: string, b: string): number;
 /** Nearest known flags within distance ≤ 2, nearest first. */

package/dist/cli.mjs

@@ -307,7 +307,8 @@ function stampRuntimeCorroboration(findings, report, scanRoot) {
 		let n = p.replace(/\\/g, "/");
 		if (scanRoot) {
 			const root = scanRoot.replace(/\\/g, "/").replace(/\/?$/, "/");
-			if (n.startsWith(root)) n = n.slice(root.length);
+			const head = n.slice(0, root.length);
+			if (/^[a-z]:\//i.test(root) ? head.toLowerCase() === root.toLowerCase() : head === root) n = n.slice(root.length);
 		}
 		return n.replace(/^\.\//, "").replace(/^\/+/, "");
 	};
@@ -2084,7 +2085,7 @@ function readCandidateBinding(root, manifestPath = CANDIDATE_MANIFEST_PATH) {
 * guarded by the version-consistency
 * spec. cli.ts re-exports this as CLI_VERSION.
 */
-const ENGINE_VERSION = "6.0.1";
+const ENGINE_VERSION = "6.1.0";
 /**
 * Build identity — WHICH BUILD IS RUNNING, as distinct from WHICH RELEASE IS
 * PUBLISHED.
@@ -2411,7 +2412,11 @@ function validateConfigSchema(config) {
 		}
 	}
 	if (cfg["plugins"] !== void 0) {
-		if (cfg["plugins"] === null || typeof cfg["plugins"] !== "object") errors.push("plugins must be an object or array");
+		if (!Array.isArray(cfg["plugins"])) errors.push(`plugins must be an array of package names or { "package": "<name>" } objects, got ${typeof cfg["plugins"]}`);
+		else for (let i = 0; i < cfg["plugins"].length; i++) {
+			const entry = cfg["plugins"][i];
+			if (!(typeof entry === "string" || entry !== null && typeof entry === "object" && !Array.isArray(entry) && typeof entry["package"] === "string")) errors.push(`plugins[${i}] must be a package name or { "package": "<name>" }, got ${JSON.stringify(entry)}`);
+		}
 	}
 	return {
 		valid: errors.length === 0,
@@ -2476,7 +2481,7 @@ function loadConfig(root, options = {}) {
 			return {
 				config: parsed,
 				path: p,
-				warnings: validate(parsed, options.knownRuleIds)
+				warnings: validate(parsed, options.knownRuleIds, options.now, name)
 			};
 		} catch (err) {
 			const msg = err.message;
@@ -2489,7 +2494,7 @@ function loadConfig(root, options = {}) {
 		warnings: []
 	};
 }
-function validate(cfg, knownRuleIds) {
+function validate(cfg, knownRuleIds, now = /* @__PURE__ */ new Date(), fileName = "mjolnir.config.json") {
 	const warnings = [];
 	const schemaResult = validateConfigSchema(cfg);
 	if (!schemaResult.valid) throw new Error(schemaResult.errors.join("; "));
@@ -2509,10 +2514,10 @@ function validate(cfg, knownRuleIds) {
 			if (!Array.isArray(ign.files)) throw new Error(`ignore for ${ign.ruleId}: "files" must be an array of glob strings, got ${typeof ign.files}`);
 			for (const g of ign.files) if (typeof g !== "string") throw new Error(`ignore for ${ign.ruleId}: "files" entries must be strings, got ${typeof g} (${JSON.stringify(g)})`);
 		}
-		if (ign.expires !== void 0 && Number.isNaN(new Date(ign.expires).getTime())) throw new Error(`ignore for ${ign.ruleId}: "expires" must be an ISO date, got "${ign.expires}"`);
-		if (ign.expires !== void 0 && !Number.isNaN(new Date(ign.expires).getTime()) && new Date(ign.expires).getTime() < Date.now()) warnings.push(`warning: ignore for ${ign.ruleId} has expired (expires "${ign.expires}") — the entry is kept but currently inactive.`);
+		if (ign.expires !== void 0 && Number.isNaN(utcMidnight(ign.expires))) throw new Error(`ignore for ${ign.ruleId}: "expires" must be an ISO date (YYYY-MM-DD), got "${ign.expires}"`);
+		if (ign.expires !== void 0 && !isSuppressionActive(ign, now)) warnings.push(`warning: ignore for ${ign.ruleId} has expired (expires "${ign.expires}") — the entry is kept but currently inactive.`);
 	}
-	for (const key of Object.keys(cfg)) if (!KNOWN_CONFIG_KEYS.has(key)) warnings.push(`warning: mjolnir.config.json has an unknown top-level key "${key}" — ignored (typo? see README §Configuration).`);
+	for (const key of Object.keys(cfg)) if (!KNOWN_CONFIG_KEYS.has(key)) warnings.push(`warning: ${fileName} has an unknown top-level key "${key}" — ignored (typo? see README §Configuration).`);
 	if (cfg.exclude !== void 0) {
 		if (!Array.isArray(cfg.exclude)) throw new Error(`exclude must be an array of strings, got ${typeof cfg.exclude}`);
 		for (const p of cfg.exclude) if (typeof p !== "string") throw new Error(`exclude entries must be strings, got ${typeof p} (${JSON.stringify(p)})`);
@@ -2534,12 +2539,22 @@ function isSuppressionActive(ign, now = /* @__PURE__ */ new Date()) {
 	if (!ign.expires) return true;
 	return utcMidnight(ign.expires) > utcMidnightOf(now);
 }
-/** UTC-midnight timestamp of an ISO date string (YYYY-MM-DD). */
+/**
+* UTC-midnight timestamp of an ISO calendar date (YYYY-MM-DD), or NaN.
+*
+* NaN for anything that is not a real calendar day, so a load-time check and
+* the active/expired verdict share one parser and cannot disagree.
+*/
 function utcMidnight(isoDate) {
-	if (!/^\d{4}-\d{2}-\d{2}$/.test(isoDate)) return NaN;
 	const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(isoDate);
 	if (!m) return NaN;
-	return Date.UTC(Number(m[1]), Number(m[2]) - 1, Number(m[3]));
+	const year = Number(m[1]);
+	const month = Number(m[2]) - 1;
+	const day = Number(m[3]);
+	const t = Date.UTC(year, month, day);
+	const back = new Date(t);
+	if (back.getUTCFullYear() !== year || back.getUTCMonth() !== month || back.getUTCDate() !== day) return NaN;
+	return t;
 }
 /** UTC-midnight timestamp of a Date (calendar day, timezone-independent). */
 function utcMidnightOf(d) {
@@ -4464,7 +4479,9 @@ const javaAdapter = {
 				const artifact = /<artifactId>([^<]+)<\/artifactId>/.exec(block[0])?.[1] ?? "";
 				for (const { re, tag } of JAVA_ARTIFACT_TAGS) if (re.test(artifact)) frameworks.add(tag);
 			}
-		} catch {}
+		} catch {
+			recordDegradation("java-manifest-unreadable");
+		}
 		for (const gradle of ["build.gradle", "build.gradle.kts"]) {
 			const path = join(root, gradle);
 			if (!existsSync(path)) continue;
@@ -4474,7 +4491,9 @@ const javaAdapter = {
 					const artifact = m[1].split(":")[1];
 					for (const { re, tag } of JAVA_ARTIFACT_TAGS) if (artifact !== void 0 && re.test(artifact)) frameworks.add(tag);
 				}
-			} catch {}
+			} catch {
+				recordDegradation("java-manifest-unreadable");
+			}
 		}
 		if (frameworks.size === 0) return {
 			frameworks: [],
@@ -4632,9 +4651,13 @@ const csharpAdapter = {
 						const pkg = m[1];
 						for (const { re, tag } of CS_PACKAGE_TAGS) if (re.test(pkg)) frameworks.add(tag);
 					}
-				} catch {}
+				} catch {
+					recordDegradation("csharp-project-unreadable");
+				}
 			}
-		} catch {}
+		} catch {
+			recordDegradation("csharp-project-unreadable");
+		}
 		if (frameworks.size === 0) return {
 			frameworks: [],
 			unknown: true
@@ -5585,6 +5608,7 @@ function computeChangedScope(root, baseBranch) {
 		...untrackedSet
 	])].sort();
 	const changed = {};
+	const fullyChanged = /* @__PURE__ */ new Set();
 	const batchDiff = (args, files) => {
 		const perFile = /* @__PURE__ */ new Map();
 		if (files.length === 0) return perFile;
@@ -5636,7 +5660,8 @@ function computeChangedScope(root, baseBranch) {
 		if (untrackedSet.has(file)) {
 			const all = allLinesOf(root, file);
 			if (all === null) {
-				changed[file] = new Set(Array.from({ length: LIMITS_MAX_LINES }, (_, i) => i + 1));
+				fullyChanged.add(file);
+				changed[file] = lines;
 				continue;
 			}
 			for (const l of all) lines.add(l);
@@ -5645,11 +5670,10 @@ function computeChangedScope(root, baseBranch) {
 	}
 	return {
 		changed,
+		...fullyChanged.size > 0 ? { fullyChanged } : {},
 		degraded: false
 	};
 }
-/** Sentinel size for "fully changed" — bounded, mirrors LIMITS.maxFileBytes scale. */
-const LIMITS_MAX_LINES = 1e6;
 /** Every 1-based line number of an untracked file (it is all new). */
 function allLinesOf(root, file) {
 	const full = join(root, file);
@@ -5699,6 +5723,7 @@ function parseChangedLines(diff) {
 function filterToChanged(findings, diff) {
 	if (diff.degraded) return findings;
 	return findings.filter((f) => {
+		if (diff.fullyChanged?.has(f.file)) return true;
 		const lines = diff.changed[f.file];
 		if (!lines) return false;
 		for (let l = Math.max(1, f.line - 3); l <= f.line; l++) if (lines.has(l)) return true;
@@ -14755,7 +14780,9 @@ function hashDir(dir, hash, depth) {
 		else if (entry.isFile() && /\.tsx?$/.test(entry.name)) try {
 			hash.update(entry.name);
 			hash.update(readFileSync(full));
-		} catch {}
+		} catch {
+			recordDegradation("rules-tree-file-unreadable");
+		}
 	}
 }
 /**
@@ -16363,13 +16390,15 @@ function runForensics(target, options = {}) {
 		report.incompleteReasons = [.../* @__PURE__ */ new Set([...report.incompleteReasons, ...incompleteReasons])];
 	}
 	let flakyMdPath;
+	let flakyMdWriteError;
 	if ((options.writeFlakyMd ?? true) && report.totalTests > 0) {
 		const base = stat.isFile() ? dirname(target) : target;
 		flakyMdPath = join(base, "FLAKY.md");
 		try {
 			writeFileAtomic(flakyMdPath, renderFlakyMd(report));
-		} catch {
+		} catch (e) {
 			flakyMdPath = void 0;
+			flakyMdWriteError = e instanceof Error ? e.message : String(e);
 		}
 	}
 	return {
@@ -16377,7 +16406,7 @@ function runForensics(target, options = {}) {
 		output: [
 			renderLeaderboard(report),
 			"",
-			flakyMdPath !== void 0 ? renderFlakyMdHint() : report.totalTests === 0 && (report.totalNetworkObservations ?? 0) > 0 && options.writeFlakyMd !== false ? "FLAKY.md was not written — network observations do not establish test outcomes." : renderFlakyMdNotWritten(options)
+			flakyMdPath !== void 0 ? renderFlakyMdHint() : report.totalTests === 0 && (report.totalNetworkObservations ?? 0) > 0 && options.writeFlakyMd !== false ? "FLAKY.md was not written — network observations do not establish test outcomes." : renderFlakyMdNotWritten(options, flakyMdWriteError)
 		].join("\n"),
 		flakyMdPath
 	};
@@ -16386,9 +16415,10 @@ function renderFlakyMdHint() {
 	return "Full details in FLAKY.md (committed artifact).";
 }
 /** Honest fallback for every case where FLAKY.md was NOT written (M2). */
-function renderFlakyMdNotWritten(options) {
+function renderFlakyMdNotWritten(options, writeError) {
 	if (options.writeFlakyMd === false) return "FLAKY.md not written (--no-flaky-md).";
-	return "FLAKY.md was not written — nothing recognized to report (or the target directory is not writable).";
+	if (writeError !== void 0) return `FLAKY.md could not be written: ${writeError}`;
+	return "FLAKY.md was not written — nothing recognized to report.";
 }
 /**
 * R5: the trace artifact's test identity. The per-test trace convention
@@ -17012,8 +17042,10 @@ function renderGateNotice(skipped) {
 * module moved. Re-exports in cli.ts keep the historical import surface.
 */
 var scan_pipeline_exports = /* @__PURE__ */ __exportAll({
+	DEFAULT_MAX_DURATION_MS: () => DEFAULT_MAX_DURATION_MS$1,
 	EVIDENCE_OVERRIDES: () => EVIDENCE_OVERRIDES$1,
 	KNOWN_RULE_IDS: () => KNOWN_RULE_IDS$1,
+	MAX_DURATION_MS: () => MAX_DURATION_MS$1,
 	OVERLAP_META_BY_RULE_ID: () => OVERLAP_META_BY_RULE_ID$1,
 	SUITE_INVALIDATING_RULE_IDS: () => SUITE_INVALIDATING_RULE_IDS$1,
 	applyPostScanProcessing: () => applyPostScanProcessing,
@@ -17030,8 +17062,13 @@ var scan_pipeline_exports = /* @__PURE__ */ __exportAll({
 	summarizeForensicVerdicts: () => summarizeForensicVerdicts
 });
 const UNIVERSAL_RULES = RULES.map(asUniversal);
-const DEFAULT_MAX_DURATION_MS$2 = 6e5;
-const MAX_DURATION_MS$2 = 36e5;
+/**
+* The scan time budget: the default, and the ceiling every surface enforces.
+* Owned here, where the clamp is applied; `cli.ts` and the MCP server import
+* these rather than keeping copies that only agree by coincidence.
+*/
+const DEFAULT_MAX_DURATION_MS$1 = 6e5;
+const MAX_DURATION_MS$1 = 36e5;
 /** Registered rule IDs — used to warn on unknown severityOverrides keys (M4). */
 const KNOWN_RULE_IDS$1 = new Set(RULES.map((r) => r.id));
 /**
@@ -17786,8 +17823,8 @@ async function runScan$1(args, hooks = {}) {
 async function runScanInProject(args, hooks = {}) {
 	const started = Date.now();
 	const degradationWindow = beginDegradationWindow();
-	const requestedDuration = Number.isFinite(args.maxDurationMs) ? args.maxDurationMs : DEFAULT_MAX_DURATION_MS$2;
-	const deadline = started + Math.min(Math.max(1, requestedDuration), MAX_DURATION_MS$2);
+	const requestedDuration = Number.isFinite(args.maxDurationMs) ? args.maxDurationMs : DEFAULT_MAX_DURATION_MS$1;
+	const deadline = started + Math.min(Math.max(1, requestedDuration), MAX_DURATION_MS$1);
 	const discovered = discoverWorkspace(args.target);
 	const targetAbs = resolve(args.target);
 	const scanRoot = discovered && discovered.root !== targetAbs && targetAbs.startsWith(discovered.root + sep) ? {
@@ -18632,10 +18669,14 @@ function isKnownTemplate(content) {
 /**
 * A generated workflow with the parts that legitimately change between
 * releases blanked: line endings, the pinned package version (in the npx
-* tarball and in the Action's `version:` input) and the pinned Action SHA.
+* tarball and in the Action's `version:` input) and every pinned action SHA
+* with its version comment. Dependabot moves the `actions/*` pins between
+* releases, so blanking only the Mjölnir Action's SHA made each of those bumps
+* turn every workflow the previous release generated into one that reads as
+* hand-customised.
 */
 function canonicalWorkflow(text) {
-	return text.replace(/\r\n/g, "\n").replace(/mjolnir-qa-[0-9A-Za-z.+-]+?\.tgz/g, "mjolnir-qa-<version>.tgz").replace(/(\n {10}version: )"[^"\n]*"/g, "$1\"<version>\"").replace(/Sergey-Bar\/Mjolnir@[0-9a-f]{40}/g, "Sergey-Bar/Mjolnir@<sha>");
+	return text.replace(/\r\n/g, "\n").replace(/mjolnir-qa-[0-9A-Za-z.+-]+?\.tgz/g, "mjolnir-qa-<version>.tgz").replace(/(\n {10}version: )"[^"\n]*"/g, "$1\"<version>\"").replace(/(uses: [^\s@]+)@[0-9a-f]{40}[^\n]*/g, "$1@<sha>");
 }
 /**
 * The action template through 6.0.0, which passed no `version:` and so ran
@@ -18699,7 +18740,7 @@ jobs:
         if: always()
         continue-on-error: true
         run: npx --yes https://registry.npmjs.org/mjolnir-qa/-/mjolnir-qa-${INSTALL_VERSION}.tgz mjolnir.json --format pr-comment > mjolnir-comment.md
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: mjolnir-report
@@ -18724,7 +18765,7 @@ ${indentBlock(gateScript(gate), 10)}
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: mjolnir-report
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -18846,7 +18887,7 @@ jobs:
           pr-comment: "false"
           trust-artifact: "false"
           annotations: "true"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: mjolnir-report
@@ -18877,7 +18918,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: mjolnir-report
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -20013,8 +20054,6 @@ function renderPwRunSummary(s) {
 */
 /** Hard caps (§21 threat model: parameter size + resource bounds). */
 const MAX_PARAM_BYTES = 65536;
-const MAX_DURATION_MS$1 = 36e5;
-const DEFAULT_MAX_DURATION_MS$1 = 6e5;
 const PROTOCOL_VERSION = "2025-06-18";
 /** The real path of `p`, or its lexical resolution when it does not exist. */
 function realOrResolved(p) {
@@ -20078,7 +20117,7 @@ const MCP_TOOLS = [
 				},
 				fixturesRoot: {
 					type: "string",
-					description: "Root directory for fixture lookups (defaults to cwd)."
+					description: "Root directory for fixture lookups (defaults to <cwd>/tests/fixtures, as for `mjolnir explain`)."
 				}
 			},
 			required: ["ruleId"]
@@ -20158,7 +20197,7 @@ function validateParams(name, args) {
 		if (typeof args["path"] !== "string" || args["path"].length === 0) return "scan requires a non-empty string `path`";
 		if (args["maxDurationMs"] !== void 0) {
 			const duration = args["maxDurationMs"];
-			if (typeof duration !== "number" || !Number.isFinite(duration) || duration <= 0 || duration > MAX_DURATION_MS$1) return "`maxDurationMs` must be a finite positive number within the server budget";
+			if (typeof duration !== "number" || !Number.isFinite(duration) || duration <= 0 || duration > 36e5) return "`maxDurationMs` must be a finite positive number within the server budget";
 		}
 	}
 	if (name === "explain") {
@@ -20262,7 +20301,7 @@ async function handleToolCall(call) {
 					message: "fixturesRoot must be a string"
 				}
 			};
-			const explanation = explainRule(ruleId, (typeof rawFixturesRoot === "string" ? rawFixturesRoot : void 0) ?? process.cwd());
+			const explanation = explainRule(ruleId, (typeof rawFixturesRoot === "string" ? rawFixturesRoot : void 0) ?? join(process.cwd(), "tests", "fixtures"));
 			if (!explanation.ok) return {
 				jsonrpc: "2.0",
 				id: call.id,
@@ -22252,6 +22291,24 @@ const MAX_FINDINGS_PER_GROUP = 25;
 function escMd(s) {
 	return sanitizeData(s).replace(/([\\`*_{}[\]()#+!|<>])/g, "\\$1");
 }
+/**
+* A Markdown code span for untrusted text.
+*
+* Backslash escapes are literal inside a code span, so `escMd` there rendered
+* `__snapshots__` as `\_\_snapshots\_\_` and `app/(auth)` as `app/\(auth\)`.
+* A span cannot be broken out of with formatting characters, only with a
+* backtick run, so it is fenced with one backtick more than the longest run
+* inside (CommonMark 6.1) and padded where the text would otherwise touch the
+* fence. Kept to one line, because a newline would end the list item.
+*/
+function mdCodeSpan(raw) {
+	const text = sanitizeData(raw).replace(/[\r\n]+/g, " ");
+	if (text.trim() === "") return "` `";
+	const longest = Math.max(0, ...[...text.matchAll(/`+/g)].map((m) => m[0].length));
+	const fence = "`".repeat(longest + 1);
+	const pad = text.startsWith("`") || text.endsWith("`") || text.startsWith(" ") && text.endsWith(" ") ? " " : "";
+	return `${fence}${pad}${text}${pad}${fence}`;
+}
 function looksLikeCode(s) {
 	return /[(;={]|await |expect\(/.test(s);
 }
@@ -22266,10 +22323,8 @@ function evidenceTagLine(f) {
 }
 function findingLineMd(f) {
 	const icon = f.severity === "error" ? "🔴" : f.severity === "warning" ? "🟡" : "🔵";
-	const fix = escMd(f.fix);
-	const fixBody = looksLikeCode(f.fix) ? `\`${fix}\`` : `_${fix}_`;
-	const safePath = escMd(f.file).replace(/[\r\n]+/g, " ");
-	return `${icon} **${escMd(f.ruleId)}** \`${safePath}:${f.line}\` — ${escMd(f.message)} ${escMd(`[${evidenceTagLine(f)}]`)}\n  Fix: ${fixBody}`;
+	const fixBody = looksLikeCode(f.fix) ? mdCodeSpan(f.fix) : `_${escMd(f.fix)}_`;
+	return `${icon} **${escMd(f.ruleId)}** ${mdCodeSpan(`${f.file}:${f.line}`)} — ${escMd(f.message)} ${escMd(`[${evidenceTagLine(f)}]`)}\n  Fix: ${fixBody}`;
 }
 /**
 * Reader-facing sentences for the `analysisStatus.reasons` tokens.
@@ -22300,7 +22355,8 @@ const REASON_PHRASES = [
 	["runtime-incomplete", "the runtime evidence set is incomplete"],
 	["identity-incomplete", "the run could not be bound to the tree it analysed"],
 	["degraded:", "capability was lost to a swallowed error"],
-	["truncated:", "the scan was cut short"]
+	["truncated:", "the scan was cut short"],
+	["coverage:quarantine:", "quarantine-tier rule(s) withheld, as in every default scan (`--include-warn` runs them)"]
 ];
 /**
 * `scope-ignored:1` -> "1 path was ignored by the scope filter".
@@ -22447,7 +22503,9 @@ function renderUnifiedReport(result, options = {}) {
 		provisionalRuleIds: [],
 		ceilingReasons: []
 	};
-	const incomplete = isIncompleteResult(result) || !result.trustSummary || summary.level === "L0" && summary.evidenceCoverage === 0;
+	const analysisIncomplete = isIncompleteResult(result) || !result.trustSummary;
+	const noEvidence = summary.level === "L0" && summary.evidenceCoverage === 0;
+	const incomplete = analysisIncomplete || noEvidence;
 	lines.push(`## <img width="16" height="16" alt="" src="${MARK_URL}"/> Mjölnir Verification Report`);
 	lines.push("");
 	lines.push("> Tests tell you what passed. Mjölnir tells you what you can trust.");
@@ -22458,8 +22516,9 @@ function renderUnifiedReport(result, options = {}) {
 	}
 	if (incomplete) {
 		const reasons = result.analysisStatus?.reasons ?? [];
+		const explained = [...reasons.length > 0 ? [humanizeReasons(reasons)] : [], ...!analysisIncomplete && noEvidence ? ["no runtime evidence corroborates this run, so an empty result is an observation, not a verdict"] : []];
 		lines.push(`> [!WARNING]
-> **Analysis status: INCOMPLETE.** ${reasons.length > 0 ? humanizeReasons(reasons) : "The scan did not complete a trustworthy analysis."}`);
+> **Analysis status: INCOMPLETE.** ${explained.length > 0 ? explained.join("; ") : "The scan did not complete a trustworthy analysis."}`);
 		lines.push("");
 	}
 	const diff = options.diff;
@@ -23173,7 +23232,7 @@ function renderStepSummary(result, options = {}) {
 		lines.push(`<details${open}>`, `<summary>${icons[sev]} ${list.length} ${sev}${list.length === 1 ? "" : "s"}</summary>`, "");
 		for (const f of list.slice(0, DETAILS_PER_SEVERITY_CAP)) {
 			const path = options.pathPrefix ? `${options.pathPrefix.replace(/\/$/, "")}/${f.file}` : f.file;
-			lines.push(`- **${escapeMarkdown(f.ruleId)}** \`${escapeMarkdown(path)}:${f.line}\` — ${escapeMarkdown(stripAnsiForSummary(f.message))}`);
+			lines.push(`- **${escapeMarkdown(f.ruleId)}** ${mdCodeSpan(`${path}:${f.line}`)} — ${escapeMarkdown(stripAnsiForSummary(f.message))}`);
 			lines.push(`  - Fix: ${escapeMarkdown(stripAnsiForSummary(f.fix))}`);
 		}
 		if (list.length > DETAILS_PER_SEVERITY_CAP) lines.push(`- … and ${list.length - DETAILS_PER_SEVERITY_CAP} more — see the full JSON artifact.`);
@@ -28218,6 +28277,19 @@ function verbFailure(error, io, debug) {
 	return 20;
 }
 /**
+* The notices a scan reports about itself, sent to the verb's own stderr.
+*
+* `fix`, `ci verify` and `handover` called `runScan` with no hooks, so a
+* config warning (an unknown key, an expired suppression) never reached the
+* user on those verbs, and the plugin gate notice bypassed `io.err`.
+*/
+function scanNotices(io) {
+	return {
+		onConfigWarning: (message) => io.err(message),
+		onGateNotice: (notice) => io.err(notice)
+	};
+}
+/**
 * The one place a run's gate level is resolved from `--blocking`, then
 * `mjolnir.config.json`, then the shipped default.
 *
@@ -28441,9 +28513,8 @@ async function runScanCommand(argv, io = {
 			...args,
 			target
 		}, {
-			onConfigWarning: (message) => io.err(message),
+			...scanNotices(io),
 			onProgress: (e) => progress.onEvent(e),
-			onGateNotice: (notice) => io.err(notice),
 			...args.debug ? { onRuleCrash: (ruleId, file, error) => {
 				const detail = error instanceof Error ? [error.message, error.stack].filter((value) => Boolean(value)).join("\n") : String(error);
 				crashLog.push(`${ruleId} crashed on ${file}: ${detail}`);
@@ -28469,7 +28540,7 @@ async function runScanCommand(argv, io = {
 			for (const line of crashLog.slice(0, 50)) io.err(`  ${line}`);
 			if (crashLog.length > 50) io.err(`  … and ${crashLog.length - 50} more`);
 		}
-		const { config, warnings } = loadConfig(target, { knownRuleIds: KNOWN_RULE_IDS$1 });
+		const { config } = loadConfig(target, { knownRuleIds: KNOWN_RULE_IDS$1 });
 		for (const d of args.deprecatedFlags ?? []) io.err(`warning: ${d.flag} is deprecated and will be removed in 7.0 — use ${d.replacement}. It still does exactly what it did; nothing about your scan changes this release.`);
 		const gate = resolveGateLevel(args.blocking, config);
 		if (args.scoreOnly) {
@@ -28496,7 +28567,6 @@ async function runScanCommand(argv, io = {
 			}
 		}
 		if (result.partial) return 2;
-		for (const w of warnings) io.err(w);
 		if (baselineFailed) return 2;
 		return scanExitCode({
 			partial: false,
@@ -28525,7 +28595,7 @@ async function runFixCommand(argv, io = {
 			...args,
 			target,
 			strict: true
-		});
+		}, scanNotices(io));
 		const fixes = planAndApplyFixes(result, target, { dryRun });
 		io.out(renderFixReport(fixes, dryRun));
 		if (result.partial) return 2;
@@ -28547,7 +28617,7 @@ async function runVerifyCommand(argv, io = {
 		const result = await runScan$1({
 			...args,
 			target
-		});
+		}, scanNotices(io));
 		const baseline = loadBaseline(join(target, DEFAULT_BASELINE_PATH), (w) => io.err(w));
 		const digest = buildVerifyDigest(result, baseline);
 		io.out(renderVerifyDigest(digest));
@@ -28646,7 +28716,7 @@ async function runHandoverCommand(argv, io = {
 		const result = await runScan$1({
 			...args,
 			target
-		});
+		}, scanNotices(io));
 		let forensics = null;
 		let forensicsFailed = false;
 		const resultsDir = join(target, "test-results");
@@ -30394,7 +30464,7 @@ function verificationBlock(version) {
 /** The per-rule remediation copy block (fenced, self-contained). */
 function ruleCopyBlock(group, version) {
 	const f = group.findings[0];
-	const occurrences = group.findings.slice(0, OCCURRENCE_CAP).map((x) => `- \`${escapeMarkdown(x.file)}:${x.line}\``).join("\n");
+	const occurrences = group.findings.slice(0, OCCURRENCE_CAP).map((x) => `- ${mdCodeSpan(`${x.file}:${x.line}`)}`).join("\n");
 	const overflow = group.findings.length > OCCURRENCE_CAP ? `\n- … and ${group.findings.length - OCCURRENCE_CAP} more — see the JSON report.` : "";
 	return [
 		"```text",
@@ -30520,7 +30590,7 @@ function renderHandoff(result, options = {}, version = ENGINE_VERSION) {
 		lines.push("");
 		lines.push(`**Occurrences (${g.findings.length}):**`);
 		lines.push("");
-		for (const f of g.findings.slice(0, OCCURRENCE_CAP)) lines.push(`- \`${escapeMarkdown(f.file)}:${f.line}\` — ${escapeMarkdown(f.message)}`);
+		for (const f of g.findings.slice(0, OCCURRENCE_CAP)) lines.push(`- ${mdCodeSpan(`${f.file}:${f.line}`)} — ${escapeMarkdown(f.message)}`);
 		if (g.findings.length > OCCURRENCE_CAP) lines.push(`- … and ${g.findings.length - OCCURRENCE_CAP} more — see the JSON report.`);
 		lines.push("");
 		lines.push(ruleCopyBlock(g, version));
@@ -32848,9 +32918,7 @@ async function runTrustTrendCommand(argv, io = {
 * identity can carry it without a cli.ts import cycle; this re-export
 * keeps every existing consumer stable.
 */
-const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isValidFindingRecord, discoverAndParseRuntimeReport, KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID, EVIDENCE_OVERRIDES, SUITE_INVALIDATING_RULE_IDS } = scan_pipeline_exports;
-const DEFAULT_MAX_DURATION_MS = 6e5;
-const MAX_DURATION_MS = 36e5;
+const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isValidFindingRecord, discoverAndParseRuntimeReport, KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID, EVIDENCE_OVERRIDES, SUITE_INVALIDATING_RULE_IDS, DEFAULT_MAX_DURATION_MS, MAX_DURATION_MS } = scan_pipeline_exports;
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",
@@ -32909,7 +32977,7 @@ function parseArgs(argv, onError) {
 			args.base = ref;
 		} else if (a === "--max-duration") {
 			const v = Number(argv[++i]);
-			if (!Number.isFinite(v) || v <= 0 || v * 1e3 > 36e5) return reject({
+			if (!Number.isFinite(v) || v <= 0 || v * 1e3 > MAX_DURATION_MS) return reject({
 				flag: "--max-duration",
 				token: argv[i]
 			});
@@ -32968,11 +33036,22 @@ function parseArgs(argv, onError) {
 	}
 	return args;
 }
-/** Scan flags that exist — the "did you mean" candidate pool. */
+/**
+* Scan flags that exist — the "did you mean" candidate pool.
+*
+* Every flag `parseArgs` accepts, and nothing it rejects. The pool had
+* drifted both ways: ten accepted flags were missing, and `--dry-run` and
+* `--version` were in it although a scan rejects them, so `mjolnir scan
+* --dry-run` answered `unknown flag "--dry-run"` and then suggested it.
+* tests/cli/help.spec.ts reads `parseArgs` to hold the two lists together.
+*/
 const KNOWN_SCAN_FLAGS = [
 	"--json",
 	"--format",
 	"--verbose",
+	"--suppressions",
+	"--suppression-gate",
+	"--policy",
 	"--scope",
 	"--base",
 	"--max-duration",
@@ -32987,12 +33066,16 @@ const KNOWN_SCAN_FLAGS = [
 	"--record-milestones",
 	"--save-baseline",
 	"--cache",
+	"--no-progress",
+	"--category",
+	"--score",
+	"--require-full-coverage",
+	"--staged",
+	"--blocking",
+	"--enable-plugins",
 	"--monorepo",
 	"--help",
-	"-h",
-	"--version",
-	"-v",
-	"--dry-run"
+	"-h"
 ];
 /** Hand-rolled Levenshtein distance (plan M2: no new dependencies). */
 function levenshtein(a, b) {
@@ -33249,13 +33332,8 @@ async function main(argv = process$1.argv.slice(2), io = {
 		io.out(renderCiSubcommandHelp());
 		return 10;
 	}
-	if (argv[0] === "ci" && argv[1] === "install") return runCiInstall(argv.slice(2), io);
 	if (argv[0] === "ci") {
 		const sub = argv[1];
-		if (sub === void 0 || sub === "--help" || sub === "-h") {
-			io.out(renderCiSubcommandHelp());
-			return sub === void 0 ? 10 : 0;
-		}
 		const entry = CI_SUBCOMMANDS[sub];
 		if (entry === void 0) {
 			io.err(`mjolnir ci: unknown subcommand "${sub}".`);
@@ -33347,6 +33425,6 @@ if (isEntryPoint()) {
 		await flushSentry();
 	}
 }
-export { ENGINE_VERSION as CLI_VERSION, DEFAULT_MAX_DURATION_MS, EVIDENCE_OVERRIDES, EXPLAIN_ARMS, KNOWN_RULE_IDS, MAX_DURATION_MS, OVERLAP_META_BY_RULE_ID, SUITE_INVALIDATING_RULE_IDS, buildUniversalRules, discoverAndParseRuntimeReport, err, exitForFindings, fallbackWorkspace, internalErrorMessage, isEntryPoint, isValidFindingRecord, levenshtein, main, nearestFlags, out, parseArgs, parseArgsOrUsage, pathMatchesGlob, printUsage, renderCiSubcommandHelp, renderScanOutput, runAnalyzeCommand, runCIIntegrityCommand, runCiAdapterCommand, runCiInstall, runContractVerifyCommand, runCrossFileCommand, runDoctorCommand, runDoctorPlaywright, runEvidenceArm, runEvidenceGraphCommand, runExplainCommand, runFixCommand, runFrameworkMaturityCommand, runHandoffCommand, runHandoverCommand, runHelpCommand, runInstallCommand, runPolicyCommand, runPrCommentCommand, runPwReportCommand, runReleaseTrustCommand, runRulesCommand, runScan, runScanCommand, runStatsCommand, runSuppressionGateCommand, runSuppressions, runTrustTrendCommand, runVerifyCommand, runWhyCommand, usageErrorMessage, validateScanTarget };
+export { ENGINE_VERSION as CLI_VERSION, DEFAULT_MAX_DURATION_MS, EVIDENCE_OVERRIDES, EXPLAIN_ARMS, KNOWN_RULE_IDS, KNOWN_SCAN_FLAGS, MAX_DURATION_MS, OVERLAP_META_BY_RULE_ID, SUITE_INVALIDATING_RULE_IDS, buildUniversalRules, discoverAndParseRuntimeReport, err, exitForFindings, fallbackWorkspace, internalErrorMessage, isEntryPoint, isValidFindingRecord, levenshtein, main, nearestFlags, out, parseArgs, parseArgsOrUsage, pathMatchesGlob, printUsage, renderCiSubcommandHelp, renderScanOutput, runAnalyzeCommand, runCIIntegrityCommand, runCiAdapterCommand, runCiInstall, runContractVerifyCommand, runCrossFileCommand, runDoctorCommand, runDoctorPlaywright, runEvidenceArm, runEvidenceGraphCommand, runExplainCommand, runFixCommand, runFrameworkMaturityCommand, runHandoffCommand, runHandoverCommand, runHelpCommand, runInstallCommand, runPolicyCommand, runPrCommentCommand, runPwReportCommand, runReleaseTrustCommand, runRulesCommand, runScan, runScanCommand, runStatsCommand, runSuppressionGateCommand, runSuppressions, runTrustTrendCommand, runVerifyCommand, runWhyCommand, usageErrorMessage, validateScanTarget };
 
 //# sourceMappingURL=cli.mjs.map

package/dist/mcp/stdio.mjs

@@ -193,7 +193,8 @@ function stampRuntimeCorroboration(findings, report, scanRoot) {
 		let n = p.replace(/\\/g, "/");
 		if (scanRoot) {
 			const root = scanRoot.replace(/\\/g, "/").replace(/\/?$/, "/");
-			if (n.startsWith(root)) n = n.slice(root.length);
+			const head = n.slice(0, root.length);
+			if (/^[a-z]:\//i.test(root) ? head.toLowerCase() === root.toLowerCase() : head === root) n = n.slice(root.length);
 		}
 		return n.replace(/^\.\//, "").replace(/^\/+/, "");
 	};
@@ -1423,7 +1424,7 @@ function readCandidateBinding(root, manifestPath = CANDIDATE_MANIFEST_PATH) {
 * guarded by the version-consistency
 * spec. cli.ts re-exports this as CLI_VERSION.
 */
-const ENGINE_VERSION = "6.0.1";
+const ENGINE_VERSION = "6.1.0";
 resolveBuildId();
 /**
 * The decision, with the process boundary already behind `runGit`.
@@ -1729,7 +1730,11 @@ function validateConfigSchema(config) {
 		}
 	}
 	if (cfg["plugins"] !== void 0) {
-		if (cfg["plugins"] === null || typeof cfg["plugins"] !== "object") errors.push("plugins must be an object or array");
+		if (!Array.isArray(cfg["plugins"])) errors.push(`plugins must be an array of package names or { "package": "<name>" } objects, got ${typeof cfg["plugins"]}`);
+		else for (let i = 0; i < cfg["plugins"].length; i++) {
+			const entry = cfg["plugins"][i];
+			if (!(typeof entry === "string" || entry !== null && typeof entry === "object" && !Array.isArray(entry) && typeof entry["package"] === "string")) errors.push(`plugins[${i}] must be a package name or { "package": "<name>" }, got ${JSON.stringify(entry)}`);
+		}
 	}
 	return {
 		valid: errors.length === 0,
@@ -1794,7 +1799,7 @@ function loadConfig(root, options = {}) {
 			return {
 				config: parsed,
 				path: p,
-				warnings: validate(parsed, options.knownRuleIds)
+				warnings: validate(parsed, options.knownRuleIds, options.now, name)
 			};
 		} catch (err) {
 			const msg = err.message;
@@ -1807,7 +1812,7 @@ function loadConfig(root, options = {}) {
 		warnings: []
 	};
 }
-function validate(cfg, knownRuleIds) {
+function validate(cfg, knownRuleIds, now = /* @__PURE__ */ new Date(), fileName = "mjolnir.config.json") {
 	const warnings = [];
 	const schemaResult = validateConfigSchema(cfg);
 	if (!schemaResult.valid) throw new Error(schemaResult.errors.join("; "));
@@ -1827,10 +1832,10 @@ function validate(cfg, knownRuleIds) {
 			if (!Array.isArray(ign.files)) throw new Error(`ignore for ${ign.ruleId}: "files" must be an array of glob strings, got ${typeof ign.files}`);
 			for (const g of ign.files) if (typeof g !== "string") throw new Error(`ignore for ${ign.ruleId}: "files" entries must be strings, got ${typeof g} (${JSON.stringify(g)})`);
 		}
-		if (ign.expires !== void 0 && Number.isNaN(new Date(ign.expires).getTime())) throw new Error(`ignore for ${ign.ruleId}: "expires" must be an ISO date, got "${ign.expires}"`);
-		if (ign.expires !== void 0 && !Number.isNaN(new Date(ign.expires).getTime()) && new Date(ign.expires).getTime() < Date.now()) warnings.push(`warning: ignore for ${ign.ruleId} has expired (expires "${ign.expires}") — the entry is kept but currently inactive.`);
+		if (ign.expires !== void 0 && Number.isNaN(utcMidnight(ign.expires))) throw new Error(`ignore for ${ign.ruleId}: "expires" must be an ISO date (YYYY-MM-DD), got "${ign.expires}"`);
+		if (ign.expires !== void 0 && !isSuppressionActive(ign, now)) warnings.push(`warning: ignore for ${ign.ruleId} has expired (expires "${ign.expires}") — the entry is kept but currently inactive.`);
 	}
-	for (const key of Object.keys(cfg)) if (!KNOWN_CONFIG_KEYS.has(key)) warnings.push(`warning: mjolnir.config.json has an unknown top-level key "${key}" — ignored (typo? see README §Configuration).`);
+	for (const key of Object.keys(cfg)) if (!KNOWN_CONFIG_KEYS.has(key)) warnings.push(`warning: ${fileName} has an unknown top-level key "${key}" — ignored (typo? see README §Configuration).`);
 	if (cfg.exclude !== void 0) {
 		if (!Array.isArray(cfg.exclude)) throw new Error(`exclude must be an array of strings, got ${typeof cfg.exclude}`);
 		for (const p of cfg.exclude) if (typeof p !== "string") throw new Error(`exclude entries must be strings, got ${typeof p} (${JSON.stringify(p)})`);
@@ -1852,12 +1857,22 @@ function isSuppressionActive(ign, now = /* @__PURE__ */ new Date()) {
 	if (!ign.expires) return true;
 	return utcMidnight(ign.expires) > utcMidnightOf(now);
 }
-/** UTC-midnight timestamp of an ISO date string (YYYY-MM-DD). */
+/**
+* UTC-midnight timestamp of an ISO calendar date (YYYY-MM-DD), or NaN.
+*
+* NaN for anything that is not a real calendar day, so a load-time check and
+* the active/expired verdict share one parser and cannot disagree.
+*/
 function utcMidnight(isoDate) {
-	if (!/^\d{4}-\d{2}-\d{2}$/.test(isoDate)) return NaN;
 	const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(isoDate);
 	if (!m) return NaN;
-	return Date.UTC(Number(m[1]), Number(m[2]) - 1, Number(m[3]));
+	const year = Number(m[1]);
+	const month = Number(m[2]) - 1;
+	const day = Number(m[3]);
+	const t = Date.UTC(year, month, day);
+	const back = new Date(t);
+	if (back.getUTCFullYear() !== year || back.getUTCMonth() !== month || back.getUTCDate() !== day) return NaN;
+	return t;
 }
 /** UTC-midnight timestamp of a Date (calendar day, timezone-independent). */
 function utcMidnightOf(d) {
@@ -3580,7 +3595,9 @@ const javaAdapter = {
 				const artifact = /<artifactId>([^<]+)<\/artifactId>/.exec(block[0])?.[1] ?? "";
 				for (const { re, tag } of JAVA_ARTIFACT_TAGS) if (re.test(artifact)) frameworks.add(tag);
 			}
-		} catch {}
+		} catch {
+			recordDegradation("java-manifest-unreadable");
+		}
 		for (const gradle of ["build.gradle", "build.gradle.kts"]) {
 			const path = join(root, gradle);
 			if (!existsSync(path)) continue;
@@ -3590,7 +3607,9 @@ const javaAdapter = {
 					const artifact = m[1].split(":")[1];
 					for (const { re, tag } of JAVA_ARTIFACT_TAGS) if (artifact !== void 0 && re.test(artifact)) frameworks.add(tag);
 				}
-			} catch {}
+			} catch {
+				recordDegradation("java-manifest-unreadable");
+			}
 		}
 		if (frameworks.size === 0) return {
 			frameworks: [],
@@ -3748,9 +3767,13 @@ const csharpAdapter = {
 						const pkg = m[1];
 						for (const { re, tag } of CS_PACKAGE_TAGS) if (re.test(pkg)) frameworks.add(tag);
 					}
-				} catch {}
+				} catch {
+					recordDegradation("csharp-project-unreadable");
+				}
 			}
-		} catch {}
+		} catch {
+			recordDegradation("csharp-project-unreadable");
+		}
 		if (frameworks.size === 0) return {
 			frameworks: [],
 			unknown: true
@@ -4664,6 +4687,7 @@ function computeChangedScope(root, baseBranch) {
 		...untrackedSet
 	])].sort();
 	const changed = {};
+	const fullyChanged = /* @__PURE__ */ new Set();
 	const batchDiff = (args, files) => {
 		const perFile = /* @__PURE__ */ new Map();
 		if (files.length === 0) return perFile;
@@ -4715,7 +4739,8 @@ function computeChangedScope(root, baseBranch) {
 		if (untrackedSet.has(file)) {
 			const all = allLinesOf(root, file);
 			if (all === null) {
-				changed[file] = new Set(Array.from({ length: LIMITS_MAX_LINES }, (_, i) => i + 1));
+				fullyChanged.add(file);
+				changed[file] = lines;
 				continue;
 			}
 			for (const l of all) lines.add(l);
@@ -4724,11 +4749,10 @@ function computeChangedScope(root, baseBranch) {
 	}
 	return {
 		changed,
+		...fullyChanged.size > 0 ? { fullyChanged } : {},
 		degraded: false
 	};
 }
-/** Sentinel size for "fully changed" — bounded, mirrors LIMITS.maxFileBytes scale. */
-const LIMITS_MAX_LINES = 1e6;
 /** Every 1-based line number of an untracked file (it is all new). */
 function allLinesOf(root, file) {
 	const full = join(root, file);
@@ -4778,6 +4802,7 @@ function parseChangedLines(diff) {
 function filterToChanged(findings, diff) {
 	if (diff.degraded) return findings;
 	return findings.filter((f) => {
+		if (diff.fullyChanged?.has(f.file)) return true;
 		const lines = diff.changed[f.file];
 		if (!lines) return false;
 		for (let l = Math.max(1, f.line - 3); l <= f.line; l++) if (lines.has(l)) return true;
@@ -13468,7 +13493,9 @@ function hashDir(dir, hash, depth) {
 		else if (entry.isFile() && /\.tsx?$/.test(entry.name)) try {
 			hash.update(entry.name);
 			hash.update(readFileSync(full));
-		} catch {}
+		} catch {
+			recordDegradation("rules-tree-file-unreadable");
+		}
 	}
 }
 /**
@@ -14903,13 +14930,15 @@ function runForensics(target, options = {}) {
 		report.incompleteReasons = [.../* @__PURE__ */ new Set([...report.incompleteReasons, ...incompleteReasons])];
 	}
 	let flakyMdPath;
+	let flakyMdWriteError;
 	if ((options.writeFlakyMd ?? true) && report.totalTests > 0) {
 		const base = stat.isFile() ? dirname(target) : target;
 		flakyMdPath = join(base, "FLAKY.md");
 		try {
 			writeFileAtomic(flakyMdPath, renderFlakyMd(report));
-		} catch {
+		} catch (e) {
 			flakyMdPath = void 0;
+			flakyMdWriteError = e instanceof Error ? e.message : String(e);
 		}
 	}
 	return {
@@ -14917,7 +14946,7 @@ function runForensics(target, options = {}) {
 		output: [
 			renderLeaderboard(report),
 			"",
-			flakyMdPath !== void 0 ? renderFlakyMdHint() : report.totalTests === 0 && (report.totalNetworkObservations ?? 0) > 0 && options.writeFlakyMd !== false ? "FLAKY.md was not written — network observations do not establish test outcomes." : renderFlakyMdNotWritten(options)
+			flakyMdPath !== void 0 ? renderFlakyMdHint() : report.totalTests === 0 && (report.totalNetworkObservations ?? 0) > 0 && options.writeFlakyMd !== false ? "FLAKY.md was not written — network observations do not establish test outcomes." : renderFlakyMdNotWritten(options, flakyMdWriteError)
 		].join("\n"),
 		flakyMdPath
 	};
@@ -14926,9 +14955,10 @@ function renderFlakyMdHint() {
 	return "Full details in FLAKY.md (committed artifact).";
 }
 /** Honest fallback for every case where FLAKY.md was NOT written (M2). */
-function renderFlakyMdNotWritten(options) {
+function renderFlakyMdNotWritten(options, writeError) {
 	if (options.writeFlakyMd === false) return "FLAKY.md not written (--no-flaky-md).";
-	return "FLAKY.md was not written — nothing recognized to report (or the target directory is not writable).";
+	if (writeError !== void 0) return `FLAKY.md could not be written: ${writeError}`;
+	return "FLAKY.md was not written — nothing recognized to report.";
 }
 /**
 * R5: the trace artifact's test identity. The per-test trace convention
@@ -15529,8 +15559,13 @@ function renderGateNotice(skipped) {
 * module moved. Re-exports in cli.ts keep the historical import surface.
 */
 const UNIVERSAL_RULES = RULES.map(asUniversal);
-const DEFAULT_MAX_DURATION_MS$1 = 6e5;
-const MAX_DURATION_MS$1 = 36e5;
+/**
+* The scan time budget: the default, and the ceiling every surface enforces.
+* Owned here, where the clamp is applied; `cli.ts` and the MCP server import
+* these rather than keeping copies that only agree by coincidence.
+*/
+const DEFAULT_MAX_DURATION_MS = 6e5;
+const MAX_DURATION_MS = 36e5;
 /** Registered rule IDs — used to warn on unknown severityOverrides keys (M4). */
 const KNOWN_RULE_IDS = new Set(RULES.map((r) => r.id));
 /**
@@ -16285,8 +16320,8 @@ async function runScan(args, hooks = {}) {
 async function runScanInProject(args, hooks = {}) {
 	const started = Date.now();
 	const degradationWindow = beginDegradationWindow();
-	const requestedDuration = Number.isFinite(args.maxDurationMs) ? args.maxDurationMs : DEFAULT_MAX_DURATION_MS$1;
-	const deadline = started + Math.min(Math.max(1, requestedDuration), MAX_DURATION_MS$1);
+	const requestedDuration = Number.isFinite(args.maxDurationMs) ? args.maxDurationMs : DEFAULT_MAX_DURATION_MS;
+	const deadline = started + Math.min(Math.max(1, requestedDuration), MAX_DURATION_MS);
 	const discovered = discoverWorkspace(args.target);
 	const targetAbs = resolve(args.target);
 	const scanRoot = discovered && discovered.root !== targetAbs && targetAbs.startsWith(discovered.root + sep) ? {
@@ -17047,8 +17082,6 @@ function renderPwRunSummary(s) {
 */
 /** Hard caps (§21 threat model: parameter size + resource bounds). */
 const MAX_PARAM_BYTES = 65536;
-const MAX_DURATION_MS = 36e5;
-const DEFAULT_MAX_DURATION_MS = 6e5;
 const PROTOCOL_VERSION = "2025-06-18";
 /** The real path of `p`, or its lexical resolution when it does not exist. */
 function realOrResolved(p) {
@@ -17112,7 +17145,7 @@ const MCP_TOOLS = [
 				},
 				fixturesRoot: {
 					type: "string",
-					description: "Root directory for fixture lookups (defaults to cwd)."
+					description: "Root directory for fixture lookups (defaults to <cwd>/tests/fixtures, as for `mjolnir explain`)."
 				}
 			},
 			required: ["ruleId"]
@@ -17192,7 +17225,7 @@ function validateParams(name, args) {
 		if (typeof args["path"] !== "string" || args["path"].length === 0) return "scan requires a non-empty string `path`";
 		if (args["maxDurationMs"] !== void 0) {
 			const duration = args["maxDurationMs"];
-			if (typeof duration !== "number" || !Number.isFinite(duration) || duration <= 0 || duration > MAX_DURATION_MS) return "`maxDurationMs` must be a finite positive number within the server budget";
+			if (typeof duration !== "number" || !Number.isFinite(duration) || duration <= 0 || duration > 36e5) return "`maxDurationMs` must be a finite positive number within the server budget";
 		}
 	}
 	if (name === "explain") {
@@ -17296,7 +17329,7 @@ async function handleToolCall(call) {
 					message: "fixturesRoot must be a string"
 				}
 			};
-			const explanation = explainRule(ruleId, (typeof rawFixturesRoot === "string" ? rawFixturesRoot : void 0) ?? process.cwd());
+			const explanation = explainRule(ruleId, (typeof rawFixturesRoot === "string" ? rawFixturesRoot : void 0) ?? join(process.cwd(), "tests", "fixtures"));
 			if (!explanation.ok) return {
 				jsonrpc: "2.0",
 				id: call.id,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mjolnir-qa",
-  "version": "6.0.1",
-  "publishedStable": "6.0.1",
+  "version": "6.1.0",
+  "publishedStable": "6.1.0",
   "description": "Mjölnir — the Verification Trust Engine for QA. Audits test suites and CI pipelines, reports a worthiness score and prioritized findings.",
   "type": "module",
   "engines": {