v1.3.0 — copy-code volume ranking, narrow hard-fail, allowlist, jscpd bridge

What's new

Copy-code audit lane — v1.3 hardening

Narrow hard-fail surface (inexcusable cases only):

• Exact file duplicates in active source (ExactFile)
• Same-name function/method copies across two or more active-source files (ExactUnitSameName), ≥10 lines / 100 tokens

All other detections (ExactUnitDifferentName, TokenBlock) are advisory-only and never reduce score.

Volume-ranked output:

• New fields on every class: instance_count, total_redundant_lines/tokens/bytes, effective_severity, hard_fail, fingerprint
• Sort order now ranks by total redundant volume across all instances (n-1) × per_instance, not per-instance size

New CLI subcommand: jankurai copy-code rank [--top N] [--by lines|tokens|bytes] [--kind all|hard-only|...]

Allowlist (agent/copy-code-allowlist.toml): stable fingerprint suppression with optional expires date; suppressed classes still appear in report under suppressed.by="allowlist"

Optional jscpd cross-check (--cross-check jscpd): advisory only, never affects score

False-positive carve-outs:

• Workspace manifests (Cargo.toml, package.json, tsconfig.json, pyproject.toml, setup.cfg) → WarningOnly
• #[derive(, #[serde(, bare impl ... { headers filtered from token-window matching

Score: shape penalty −10 (was −18); cap at 70 unchanged
Schema: copy-code 1.1.0; standard 1.9.0; auditor 1.3.0

Tests

610 #[test] functions (16 new copy-code tests covering FP carve-outs, allowlist, rank ordering, rename invariance, schema roundtrip, jscpd bridge)

Upgrade notes

Copy-code schema bumped to 1.1.0 — new fields are required in the schema; existing reports are incompatible. Regenerate with:

cargo run -p jankurai -- copy-code . --json target/jankurai/copy-code.json