cejel

Evidence about a repository that anyone can rerun. Cejel reads a repository's own evidence (tests that really assert something, committed secrets, CI gating) and writes a certificate pinned to one commit. Whoever receives it, a customer, a buyer or an acquirer, can run the same Cejel version on the same commit themselves, offline, and get the same result. No LLM, no signup.

Add it to a workflow; the result is posted to the job summary:

on: [pull_request]
jobs:
  cejel:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # full history: A2 and B2 read commit history
      - uses: BargLabs/cejel/action@v1

Or run it once from a shell: npx @cejel/cejel@latest . More on the Action under GitHub Action.

Cejel ("SEH-jel") — a trust certificate for your codebase.

Free, offline, no-signup CLI that scores the engineering signals that tell you whether to trust a repo — tests, secrets, isolation, claim-vs-reality, CI/audit discipline — and prints a trust certificate + badge. Especially valuable when AI wrote a lot of the code: that's exactly when you can't eyeball trust. Built on a deterministic, no-LLM scoring core — the free path makes zero network calls and requires no account.

Claim boundary: Cejel scores engineering-trust signals; it does not claim to detect software defects or prove that code is safe. Defect and vulnerability scanners remain evidence producers that Cejel can aggregate into a trust certificate.

Cejel is not another point scanner competing with the one you already run — it's the open, portable, offline trust certificate that aggregates them. Pipe in SARIF-compatible output (MunaTrust, Snyk, Semgrep, CodeQL, Codex) plus OpenSSF Scorecard, and get one shareable certificate + badge over all of them. See "Aggregate your scanners" below.

Cejel is used on Barg Labs’ own code. The public board labels publisher-owned snapshots separately from the ranked public repositories.

Rubric calibration policy

The public CLI default is witan-rubric-v17-2026-07-24, the last rubric to clear Cejel's preregistered 200-repository untouched holdout. Published calibration figures apply only to that exact rubric and frozen evaluation population. Later rubrics—including the current v18 through v23 prospective series—are available only to explicit evaluation harnesses. Prospective rubrics inherit none of v17's calibration figures; a bounded paired repair or corpus-delta result can validate its stated construction without transferring precision, recall, or false-positive-rate claims. Promoting a prospective rubric to the public default requires a fresh authenticated untouched holdout, every preregistered gate to pass, and a separately recorded promotion decision.

Measured recall (bounded)

Measured recall (bounded). Cejel publishes one cohort-level in-scope detection-recall figure, for the prospective v22 rubric, in docs/calibration/v22-detection-recall/; no general figure exists, and the three quantities called recall are set side by side on cejel.dev/methodology. On a frozen, preregistered, in-scope held-out fixture set of 30 named defects, the released public default (v17, tree a857f0b3) cited 16/30, two-sided 95% Wilson interval [36.1%, 69.8%]; the prospective v22 detector (commit 8a289ea, tree 10960a03) cited 24/30, two-sided 95% Wilson interval [62.7%, 90.5%]. Same fixtures, same partition, same controls in both runs. v22 is prospective and not the shipped default. Full preregistrations and results: docs/experiments/in-scope-detection-recall-v3-result-2026-08-09.md and docs/experiments/in-scope-detection-recall-v4-result-2026-08-11.md.

The defect-class census publishes the coverage-breadth boundary—which defect classes any shipped rule targets—and is explicitly not a recall claim.

Install

No account, no key, no signup.

Single-file binary. One file. No Node, no npm, no node_modules, nothing installed.

set -eu
asset="cejel-$(uname -s)-$(uname -m)"
curl -fsSL "https://github.com/BargLabs/cejel/releases/latest/download/$asset" -o "$asset"
curl -fsSL https://github.com/BargLabs/cejel/releases/latest/download/SHA256SUMS -o SHA256SUMS
checksum_entry_count="$(awk -v asset="$asset" '$2 == asset { count++ } END { print count + 0 }' SHA256SUMS)"
if [ "$checksum_entry_count" -ne 1 ]; then
  echo "Expected exactly one SHA256SUMS entry for $asset; found $checksum_entry_count" >&2
  exit 1
fi
if command -v sha256sum >/dev/null; then
  grep "  $asset$" SHA256SUMS | sha256sum -c -
else
  grep "  $asset$" SHA256SUMS | shasum -a 256 -c -
fi
mv "$asset" cejel
chmod +x cejel
./cejel .

Windows x86_64 (PowerShell).

$asset = "cejel-Windows-x86_64.exe"
Invoke-WebRequest "https://github.com/BargLabs/cejel/releases/latest/download/$asset" -OutFile $asset
Invoke-WebRequest "https://github.com/BargLabs/cejel/releases/latest/download/SHA256SUMS" -OutFile SHA256SUMS
$expected = ((Select-String -Path SHA256SUMS -Pattern "  $([regex]::Escape($asset))$").Line -split "\s+")[0]
$actual = (Get-FileHash -Algorithm SHA256 $asset).Hash.ToLowerInvariant()
if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
  throw "SHA-256 verification failed for $asset"
}
.\cejel-Windows-x86_64.exe .

Windows signing status: cejel-Windows-x86_64.exe is intentionally unsigned in 0.6.8 and may trigger Microsoft SmartScreen. The release build removes Node's inherited signature before SEA injection and fails unless Windows reports the result as NotSigned; it does not ship an invalid signature. Before running it, verify SHA256SUMS and the GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM (the packages bundled into it, listed from the build, and the Node.js runtime it embeds; from the release after 0.6.0 it is attested to the binary) and an own-platform verification receipt covering --version, --help, a real scan, source/binary parity, and a network-denied scan. If your policy requires Authenticode, use the npm package or the OCI image until a human-approved signing path is available.

Don't take the offline claim on trust — check it. Turn your network off, then run the binary. It will score your repository and write you a certificate anyway. That is the whole product, and you can falsify it in ten seconds:

# with Wi-Fi off, or:
docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debian:stable-slim /cejel .

npm.

npx @cejel/cejel@latest .

Distribution note: Cejel 0.6.8 is the coordinated release version for npm, standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry. A GitLab CI template and Code Quality export live in docs/gitlab-ci.md.

npx can reuse a stale cached package. Force the current npm release with the @latest specifier above, and check the version that will run before comparing certificates:

npx @cejel/cejel@latest --version

If a root package.json still carries a template name, override only the certificate display name while keeping the repository-derived stable slug:

npx @cejel/cejel@latest . --name "Customer Portal"

From 0.4.5, use --product-name when two checkout directories must emit the same identity fields. The supplied value sets both the display name and its slugified stable ID:

npx @cejel/cejel@latest . --product-name "Customer Portal"

Product identity is caller context, not scored repository evidence, and is excluded from certificate byte-comparison claims.

The npm package is scoped as @cejel/cejel; its executable remains the short command cejel.

GitHub Action — score every PR and publish the badge:

- uses: actions/checkout@v4
  with:
    fetch-depth: 0     # full history: A2 and B2 read commit history
- uses: BargLabs/cejel/action@v1
  with:
    min-score: "2.5"   # optional: fail the build below this

actions/checkout fetches one commit by default, so clone in full with fetch-depth: 0. On a shallow clone the criteria that read commit history see only the commits it holds: A2's scans of earlier commits for .env files and credentials read only those, and B2 withholds its pull-request merge ratio, or abstains where nothing else is left to score it on, saying why in its note. The certificate says so under "History limitations". Under the opt-in prospective v27 rubric (--rubric-pin witan-rubric-v27-prospective-2026-10-19; v17 remains the default), A2 abstains on a shallow clone unless a confirmed critical secret finding stands, including where it would otherwise be marked not applicable, since that decision also rests on earlier commits. That abstention is left out of the composite, but the verdict is capped at the band the composite reaches with it counted as 0. A2 also abstains under v27 on any clone where one of its reads of earlier commits failed: for example on a partial clone made with --filter, which fetch-depth: 0 and no filter avoid, or where a read stops at one of Cejel's own limits: an output limit or the history secret scan's cap of 5,000 historical files, which happen on some large complete histories and which a re-scan of the same repository does not lift (#567), or the 30-second timeout, which a re-scan may lift. It also abstains when it leaves a credential-shaped path in history unread because the path's name contains control characters, and when git itself cannot be run on the scanning host. Each of these abstentions counts as 0 in the composite, so they can lower the v27 score.

For an executed public example that binds a release artifact to the same commit named by its Cejel certificate, see Certified releases with GitHub build provenance.

From source — it is AGPL and it runs offline, so reading it is rather the point:

git clone https://github.com/BargLabs/cejel && cd cejel
pnpm install && pnpm build
node dist/index.js .

Released binaries: cejel-Darwin-arm64, cejel-Darwin-x86_64, cejel-Linux-aarch64, cejel-Linux-x86_64, and cejel-Windows-x86_64.exe. The release also carries SHA256SUMS, a per-binary SPDX SBOM, and an own-platform verification receipt. The SBOM lists the packages bundled into the binary plus its embedded Node.js runtime. The 0.6.0 SBOMs do not: they list only the scanned directory and the binary. See docs/release-process.md. Each binary is executed against the source build and with networking denied before attachment. Releases from v0.1.6 also carry a Sigstore bundle containing GitHub's signed build-provenance attestation for the release set. Verify a downloaded binary with:

gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel

This is cryptographically signed provenance. It is distinct from Apple Developer ID or Microsoft Authenticode code-signing.

Docker / OCI. The current container release is 0.6.8:

docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.6.8

The image defaults to cejel-mcp over stdio. To use the CLI instead:

docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.6.8 .

The OCI image carries an SBOM of its base-image packages, maximum-mode build provenance, and a signed registry attestation. From the release after 0.6.0 it also carries a second SPDX attestation listing the packages Cejel bundles. The 0.6.0 image's SBOM does not list those.

Leaderboard

The Cejel OSS trust leaderboard is hosted on cejel.dev, which is the single current board. This repository no longer distributes a second copy of its scores or certificates. The board records its producing package version, rubric, run date, pinned public revisions, and reproduction instructions for that particular run. The board's row for Barg Labs' own private codebase is a transparency snapshot and is not independently reproducible.

The site's History section preserves the 2026-08-18 withdrawal: the earlier sealed-public-scorer reproducibility claim was false. The stale prospective-rubric copy previously linked here has been removed; it must not be treated as current evidence.

Redaction policy

A path is published exactly when the reader can check it. Every public repository on the board cites full evidence paths and line numbers, everywhere, in every artifact — a certificate whose evidence you cannot open is not evidence. The private-repository entry (the studio monorepo's transparency snapshot) never cites a source path, anywhere, in any field or format — but the finding itself, its dimension, status, score, and content hash always survive; only the location is withheld, marked uniformly as "path withheld — private repository". Redaction removes a location, never a fact: a private repository failing its own check still shows up on its certificate, by name. The v3 repository scanner marks B1 and B5 not applicable for every repository, including ours; it does not accept structured substrate evidence for them. They remain defined for other rubric inputs, while the repository ranking excludes them fail-closed. Nobody is scored on evidence the public scanner cannot collect.

Known false positives (fixed before publishing)

Calibrating a rubric against real, elite repositories surfaces mistakes; the record is part of the trust claim, not something to bury. Two dimensions produced a punitive score for the absence of a ratable surface rather than a real weakness, and both are fixed: Django was flagged critical on dependency hygiene for using version ranges instead of exact pins — normal, deliberate practice for a library, not an app; the rubric now scores dependency hygiene against archetype-appropriate norms. OSSF Scorecard — Google's own supply-chain security auditing tool — was flagged critical on audit-trail completeness for publishing release notes via GitHub Releases instead of a committed CHANGELOG.md; a repository with no ratable audit surface now returns "insufficient data" (excluded from the composite) instead of a punitive score. The board also publishes a measured-coverage indicator per row: a score reflects only its measured dimensions, and a row scored on fewer than half of its applicable dimensions is shown as unranked rather than ordered against better-evidenced rows.

Usage

./cejel scan .

scan scores the current directory with sensible defaults: no signup, fully offline. The original ./cejel . form remains supported as a compatibility shorthand. Prints a concise terminal certificate and writes to .cejel/:

• report.json — the full structured report; scored runs carry numeric headline scores and a score-band verdict, while abstained runs carry null scores and verdict: "insufficient_source"
• attestation.json — an unsigned in-toto statement binding the report digest, repository revision, rubric, and scored-or-abstained outcome; ready for an external signer
• certificate.html — a self-contained HTML certificate (no external assets)
• badge.json — a shields.io endpoint payload
• badge.svg — a static, self-contained trust-score badge
• summary.json — a compact digest (score, verdict, top findings)

The attestation is deliberately explicit about its assurance level: Cejel creates the statement, but it does not pretend to be an independent signer. Until a customer, reviewer, or provenance system signs it, assurance.status is unsigned and issuer is self-generated. An abstained scan carries only the refusal reason, never a numeric score.

Verify that an emitted report still matches its attestation:

./cejel verify .cejel/report.json .cejel/attestation.json

This verifies the report schema and the report-to-attestation digest, repository, rubric, timestamp, and outcome binding. It does not verify a signature or signer identity; the command prints that boundary on every successful verification.

Flags

• <path> — repo to score (default: current directory)
• --out <dir> — where to write report/certificate/badge files (default: .cejel; --out-dir remains available as a compatibility alias)
• --min-score <n> — exit non-zero if the overall score is below n (0–4), if Cejel abstains, or if fewer than half of the applicable dimensions behind any score were measured; used by the GitHub Action's optional threshold gate
• --product-name <name> — Set both the caller-context display name and slugified product ID so differently named checkouts can emit identical certificates.
• --name <display> — override only the displayed project name while leaving the derived slug unchanged; retained for compatibility
• --ingest <file|glob> — fold another scanner's output into the score (repeatable). Accepts SARIF, OpenSSF Scorecard JSON, or the generic Cejel external-signal shape — format is auto-detected. See "Aggregate your scanners" below.
• --subject-repository <repo> — name the scanned repository (github.com/owner/repo or a clone URL) so an ingested input that declares another repository is recorded as mismatched. Cejel never infers it from clone state.
• --strict-ingest — refuse, before scoring, an ingested input that declares another repository or commit, was observed before the scanned commit existed, or duplicates another input. Without it, the binding status is recorded and scoring is unchanged. See input binding.
• --rubric-pin <version> — Explicit opt-in only: pin an alternate rubric instead of the calibrated public default. It accepts the calibrated version or any published prospective rubric (witan-rubric-v18-prospective-* through v26) and fails closed, naming what was accepted, on anything else. v26 (witan-rubric-v26-prospective-2026-10-14) is prospective and uncalibrated: it is the next calibration candidate, inherits v25 complete, inherits neither v23 nor v24, and today scores exactly as v25 does. v25 is prospective and uncalibrated: it inherits v22 and adds only credit for a health or readiness route declared inline in an application file (see "What counts as a health or readiness signal" below). v23 is prospective and uncalibrated, like every rubric after v17: the public default (WITAN_LAST_CALIBRATED_RUBRIC_VERSION) is still witan-rubric-v17-2026-07-24, and v23 inherits none of v17's precision, recall, or false-positive-rate figures. It inherits v22 detector/scoring behavior and adds bounded A1 coverage-flag recognition (#276) plus per-signal (rather than per-criterion) abstention for A1's coverage_percent/non_hollow_test_share metrics (#278); every other criterion still abstains criterion-wide under v23, same as v17/v22. Omit this flag for the calibrated result every default scan produces — a prospective pin carries no precision/recall claim, and the terminal certificate, HTML certificate, and Markdown report all state that plainly whenever one is used.
• --run-attempt <n> — record which CI run attempt produced this certificate, surfaced on the human-readable certificate and as an additive-optional predicate.githubRunAttempt field on attestation.json. The GitHub Action sets this automatically from GITHUB_RUN_ATTEMPT; omit it for a local scan or any other CI —