v3.5.0

[3.5.0] - 2026-08-20

The interoperability release: findings speak the industry's language.
Every finding carries a MITRE CWE where a defensible mapping exists, and
the review renders as SARIF 2.1.0 for GitHub code scanning - so the gate's
output lands in the Security tab of every consuming repository, tagged by
weakness class, instead of living only in annotations and logs.

Added

• CWE tagging across all four engines. Deferral prose and markers are
  CWE-546 (Suspicious Comment); empty function/loop bodies are CWE-1071
  (Empty Code Block); empty catch/except handling is CWE-1069 (Empty
  Exception Block); stubs that fake their contract (hardcoded returns,
  not-implemented throws, panic()/todo!() stubs) are CWE-684 (Incorrect
  Provision of Specified Functionality); unreachable code is CWE-561,
  constant conditions are CWE-570/571 selected by actual polarity, and
  the Po10 metrics are CWE-1121/1120. Engines attach identical IDs to
  byte-identical finding texts, so deduplication can never merge findings
  that disagree about their weakness class. Absence of cwe is a
  statement - no honest mapping exists (mock/fake/passthrough classes) -
  and tests pin both directions.
• SARIF 2.1.0 output. to_sarif() renders a review with stable
  ruleIds derived from the constitution failure classes, severity-mapped
  levels, real line coordinates, and CWE tags on rules and results.
  Skipped files and pre-existing debt contribute nothing: SARIF gates
  exactly what the verdict gates.
• --sarif-file PATH on the CLI (written before stdout output; an
  unwritable path is an operational error, exit 3, not a crash) and a
  sarif-file input on the composite action, which uploads to code
  scanning via SHA-pinned codeql-action - skipped automatically for fork
  PRs, whose tokens cannot upload. Dogfooded on this repository's own
  PR gate.

Scanner accuracy measured by this release build

Adversarial corpus: 24 violations, 13 legitimate samples, 37 total
  prose rules only   24/37  (64%)
  union (shipped)    37/37  (100%)
Union at or above baseline (37/37 >= 37).