cejel

# cejel

[![release](https://img.shields.io/github/v/release/BargLabs/cejel)](https://github.com/BargLabs/cejel/releases/latest)
[![license: AGPL-3.0-only](https://img.shields.io/badge/license-AGPL--3.0--only-blue.svg)](./LICENSE)

Cejel (*"SEH-jel"*) — a trust certificate for your codebase.

Free, offline, no-signup CLI that scores the engineering signals that tell you whether to
trust a repo — tests, secrets, isolation, claim-vs-reality, CI/audit discipline — and prints
a trust certificate + badge. Especially valuable when AI wrote a lot of the code: that's
exactly when you can't eyeball trust. Built on a deterministic, no-LLM scoring core — the
free path makes zero network calls and requires no account.

**Claim boundary:** Cejel scores engineering-trust signals; it does not claim to detect software
defects or prove that code is safe. Defect and vulnerability scanners remain evidence producers
that Cejel can aggregate into a trust certificate.

Cejel is not another point scanner competing with the one you already run — it's the open,
portable, offline trust certificate that aggregates them. Pipe in SARIF-compatible output
(MunaTrust, Snyk, Semgrep, CodeQL, Codex) plus OpenSSF Scorecard, and get one shareable
certificate + badge over all of them. See "Aggregate your scanners" below.

> Dogfooded in production. Cejel is run continuously on Barg Labs' own multi-product
> monorepo — the ten-product studio it was built inside — which it currently scores
> 3.3/4.0 on its rubric-native certificate. That transparency snapshot opts into prospective
> v18; the public CLI default remains calibrated v17. On the comparative board, our code sits
> outside the ranked population and receives no verdict band. We score ourselves before
> asking you to score yourself.

### Rubric calibration policy

The public CLI default is `witan-rubric-v17-2026-07-24`, the last rubric to clear Cejel's
preregistered 200-repository untouched holdout. Published calibration figures apply only to that
exact rubric and frozen evaluation population. Later rubrics—including the current v18 through
v23 prospective series—are available only to explicit evaluation harnesses. Prospective rubrics
inherit none of v17's calibration figures; a bounded paired repair or corpus-delta result can
validate its stated construction without transferring precision, recall, or false-positive-rate
claims. Promoting a prospective rubric to the public default requires a fresh authenticated
untouched holdout, every preregistered gate to pass, and a separately recorded promotion decision.

### Measured recall (bounded)

> **Measured recall (bounded).** Cejel publishes no general detection-recall figure. On a frozen,
> preregistered, in-scope held-out fixture set of 30 named defects, the released public default
> (v17, tree `a857f0b3`) cited **16/30**, two-sided 95% Wilson interval **[36.1%, 69.8%]**; the
> prospective v22 detector (commit `8a289ea`, tree `10960a03`) cited **24/30**, two-sided 95%
> Wilson interval **[62.7%, 90.5%]**. Same fixtures, same partition, same controls in both runs.
> v22 is prospective and not the shipped default. Full preregistrations and results:
> `docs/experiments/in-scope-detection-recall-v3-result-2026-08-09.md` and
> `docs/experiments/in-scope-detection-recall-v4-result-2026-08-11.md`.

The [defect-class census](docs/defect-class-census.md) publishes the coverage-breadth
boundary—which defect classes any shipped rule targets—and is explicitly not a recall claim.

## Install

No account, no key, no signup.

**Single-file binary.** One file. No Node, no npm, no `node_modules`, nothing installed.

```bash
set -eu
asset="cejel-$(uname -s)-$(uname -m)"
curl -fsSL "https://github.com/BargLabs/cejel/releases/latest/download/$asset" -o "$asset"
curl -fsSL https://github.com/BargLabs/cejel/releases/latest/download/SHA256SUMS -o SHA256SUMS
checksum_entry_count="$(awk -v asset="$asset" '$2 == asset { count++ } END { print count + 0 }' SHA256SUMS)"
if [ "$checksum_entry_count" -ne 1 ]; then
  echo "Expected exactly one SHA256SUMS entry for $asset; found $checksum_entry_count" >&2
  exit 1
fi
if command -v sha256sum >/dev/null; then
  grep "  $asset$" SHA256SUMS | sha256sum -c -
else
  grep "  $asset$" SHA256SUMS | shasum -a 256 -c -
fi
mv "$asset" cejel
chmod +x cejel
./cejel .
```

**Windows x86_64 (PowerShell).**

```powershell
$asset = "cejel-Windows-x86_64.exe"
Invoke-WebRequest "https://github.com/BargLabs/cejel/releases/latest/download/$asset" -OutFile $asset
Invoke-WebRequest "https://github.com/BargLabs/cejel/releases/latest/download/SHA256SUMS" -OutFile SHA256SUMS
$expected = ((Select-String -Path SHA256SUMS -Pattern "  $([regex]::Escape($asset))$").Line -split "\s+")[0]
$actual = (Get-FileHash -Algorithm SHA256 $asset).Hash.ToLowerInvariant()
if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
  throw "SHA-256 verification failed for $asset"
}
.\cejel-Windows-x86_64.exe .
```

> **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
> 0.4.7 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
> signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
> it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
> GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM and an
> own-platform verification receipt covering `--version`, `--help`, a real scan,
> source/binary parity, and a network-denied scan. If your policy requires Authenticode,
> use the npm package or the OCI image until a human-approved signing path is available.

**Don't take the offline claim on trust — check it.** Turn your network off, then run the
binary. It will score your repository and write you a certificate anyway. That is the whole
product, and you can falsify it in ten seconds:

```bash
# with Wi-Fi off, or:
docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debian:stable-slim /cejel .
```

**npm.**

```bash
npx @cejel/cejel@latest .
```

> **Distribution note:** Cejel `0.4.7` is the coordinated release version for npm,
> standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry.

`npx` can reuse a stale cached package. Force the current npm release with the `@latest`
specifier above, and check the version that will run before comparing certificates:

```bash
npx @cejel/cejel@latest --version
```

If a root `package.json` still carries a template name, override only the certificate display
name while keeping the repository-derived stable slug:

```bash
npx @cejel/cejel@latest . --name "Customer Portal"
```

From 0.4.5, use `--product-name` when two checkout directories must emit the
same identity fields. The supplied value sets both the display name and its slugified stable ID:

```bash
npx @cejel/cejel@latest . --product-name "Customer Portal"
```

Product identity is caller context, not scored repository evidence, and is excluded from
certificate byte-comparison claims.

The npm package is scoped as `@cejel/cejel`; its executable remains the short command `cejel`.

**GitHub Action** — score every PR and publish the badge:

```yaml
- uses: BargLabs/cejel/action@v1
  with:
    min-score: "2.5"   # optional: fail the build below this
```

For an executed public example that binds a release artifact to the same commit named by its
Cejel certificate, see [Certified releases with GitHub build provenance](./docs/certified-release-example.md).

**From source** — it is AGPL and it runs offline, so reading it is rather the point:

```bash
git clone https://github.com/BargLabs/cejel && cd cejel
pnpm install && pnpm build
node dist/index.js .
```

Released binaries: `cejel-Darwin-arm64`, `cejel-Darwin-x86_64`, `cejel-Linux-aarch64`,
`cejel-Linux-x86_64`, and `cejel-Windows-x86_64.exe`. The release also carries
`SHA256SUMS`, a per-binary SPDX SBOM, and an own-platform verification receipt. Each binary
is executed against the source build and with networking denied before attachment. Releases
from v0.1.6 also carry a Sigstore bundle containing GitHub's signed build-provenance
attestation for the release set. Verify a downloaded binary with:

```bash
gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
```

This is cryptographically signed provenance. It is distinct from Apple Developer ID or
Microsoft Authenticode code-signing.

**Docker / OCI.** The current container release is `0.4.7`:

```bash
docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.7
```

The image defaults to `cejel-mcp` over stdio. To use the CLI instead:

```bash
docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.7 .
```

The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
attestation.

## Leaderboard

This repo ships the [Cejel OSS trust leaderboard](./leaderboard/leaderboard.md): elite OSS
projects, the public Cejel repository itself, and one explicitly labeled transparency
snapshot from the private studio monorepo where Cejel was built, with a per-repository
evidence report for every row under [`leaderboard/reports/`](./leaderboard/reports/). The
board is also hosted at [cejel.dev](https://cejel.dev). Every score is produced by the same
sealed public scorer used by `npx @cejel/cejel@latest .`; no private domain collector contributes.
For each public-repository row, check out the immutable source commit printed in its report
and run the public scorer to reproduce the score, verdict, measured coverage, and evidence.
The private Alfred snapshot discloses its limitation instead: its source commit and withheld
locations are not publicly available, so that row is not independently reproducible and is
not presented as a public-repository self-score.

### Redaction policy

A path is published exactly when the reader can check it. Every public repository on the
board cites full evidence paths and line numbers, everywh