v0.3.1

Breaking

• report.json and summary.json no longer include generatedAt. The machine-readable scan
  time is provenance for the run, not a repository finding, and now lives in
  attestation.json; the certificate retains its existing human-readable date. Re-running the
  same input now produces byte-identical report and summary artifacts; consumers that read
  generatedAt from either artifact must instead read attestation.json.

Added

• A separate opt-in D-series pack entrypoint adds the high-confidence D1
  declared-but-unread-config rule. It uses Cejel's resolved TypeScript module graph, cites the
  exact declaration path, and abstains on dynamic config access. It does not feed A1-B6 scoring;
  the frozen three-seed D1 baseline remains unchanged and exact-signature acceptance is reported
  separately.
• The opt-in D-series pack adds a narrow D2 swallowed-error rule for an awaited operation whose
  catch discards its bound error while returning a static failure result. Exact acceptance and the
  23-repository precision gate are reported separately because the frozen 16-case suite contains
  no D2 seed. The rule does not feed A1-B6 scoring or change the published leaderboard.
• The opt-in D-series pack adds a narrow D3 unasserted-set-transform rule for a filter that reports
  literal success while pairing retained output with a statically empty explanation ledger. Exact
  acceptance and the 23-repository precision gate are reported separately; the frozen five-seed D3
  baseline remains unchanged. The rule does not feed A1-B6 scoring or change the leaderboard.
• The opt-in D-series pack adds a narrowly bounded D4 rule for an exact caller/callee shape where a
  statically signalled failure is converted to an empty collection and then returned as literal
  success. It does not infer that emptiness is itself defective, feed A1-B6 scoring, or claim any
  of the four frozen semantic D4 seeds as caught.
• The opt-in D-series pack adds the high-confidence D5 self-referential-verification rule for
  equality assertions whose visibly named expected value and exercised code are imported from the
  same first-party module. It cites the assertion path and remains outside A1-B6 scoring; the frozen
  four-seed D5 baseline remains unchanged and exact-signature acceptance is reported separately.

Release provenance

0.3.1 is the first Cejel release published with build provenance. The npm package and the
container image both carry attestations naming commit
c48778d54444870a8185d09bdfe5b966ff309221 at ref refs/tags/v0.3.1.

0.3.0 was tagged and built but never published — the registry rejected the upload after a
transparency-log entry had already been created for that real build. The v0.3.0 tag remains
in place; 0.3.1 is its successor, not a retagged retry.

Verify

npm view @cejel/cejel@0.3.1 --json
curl -s "https://registry.npmjs.org/-/npm/v1/attestations/@cejel%2fcejel@0.3.1"

Both resolve to the commit above.