fix: stabilization pass — twelve correctness fixes across core, fetch, cli and report

.github/actions/dependable-check/README.md

@@ -5,7 +5,7 @@ A composite action that installs the released `dependable` binary and runs
 
 ```yaml
 - uses: actions/checkout@v4
-- uses: getkono/dependable/.github/actions/dependable-check@v0.1.4
+- uses: getkono/dependable/.github/actions/dependable-check@v0.1.3
   with:
     fail-on: vulnerable
 ```
@@ -37,7 +37,7 @@ single valid document while the annotations still reach the pull request.
 | `fail-on` | `vulnerable` | `none`, `outdated`, `vulnerable`, or `any`. |
 | `format` | `table` | `table`, `json`, `text`, or `sarif` — what goes to stdout. |
 | `annotations` | `auto` | `auto`, `always`, or `never`. `never` also turns off the job summary. |
-| `version` | `latest` | A release tag such as `v0.1.4`, or `latest`. |
+| `version` | `latest` | A release tag such as `v0.1.3`, or `latest`. |
 | `args` | `''` | Extra arguments appended to `dependable check` verbatim. |
 
 **`fail-on` defaults to `vulnerable`, deviating from the CLI's `none`.** This is
@@ -59,7 +59,7 @@ Counts are deliberately not outputs: they would duplicate the JSON schema and
 drift from it.
 
 ```yaml
-- uses: getkono/dependable/.github/actions/dependable-check@v0.1.4
+- uses: getkono/dependable/.github/actions/dependable-check@v0.1.3
   id: deps
   continue-on-error: true
   with:
@@ -83,7 +83,7 @@ Releases are tagged `v{version}` only — there is **no floating `v1` tag** —
 pin a full tag:
 
 ```yaml
-uses: getkono/dependable/.github/actions/dependable-check@v0.1.4
+uses: getkono/dependable/.github/actions/dependable-check@v0.1.3
 ```
 
 `version: latest` resolves the newest release at run time; pinning `version:` to

.github/actions/dependable-check/action.yml

@@ -40,7 +40,7 @@ inputs:
     default: 'auto'
   version:
     description: >-
-      Release tag to install, such as v0.1.4, or latest. Pinning a tag skips the
+      Release tag to install, such as v0.1.3, or latest. Pinning a tag skips the
       releases API call, so a workflow with no contents read permission must pin.
     required: false
     default: 'latest'

.github/workflows/live.yml

@@ -0,0 +1,35 @@
+# The `#[ignore]`d network tests, on a schedule.
+#
+# `mise run test` is hermetic by design, so the entire network-facing surface —
+# the crates.io sparse index, npm, PyPI, Packagist, pub.dev, NuGet, Hex, JSR and
+# OSV — is never exercised by CI. Those are also the least-covered modules in the
+# workspace, and the ones whose correctness depends on a schema this repository
+# does not control: when a registry changes a response shape, nothing here notices
+# until a user reports a wrong answer.
+#
+# Deliberately not part of the PR gate. These tests fail for reasons a contributor
+# cannot fix — an outage, a rate limit — and a gate that cries wolf gets ignored,
+# including on the day it is right.
+name: Live
+
+on:
+  schedule:
+    # 05:00 UTC daily, off the top of the hour to avoid the cron stampede.
+    - cron: "17 5 * * *"
+  workflow_dispatch:
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  live:
+    name: Live registry + OSV smoke tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Materialize Rust toolchain
+        run: rustup show active-toolchain || rustup show
+      - uses: Swatinem/rust-cache@v2
+      - uses: jdx/mise-action@v2
+      - name: Run the live tests
+        run: mise run test:live

AGENTS.md

@@ -1,8 +1,11 @@
 # dependable
 
 Open-source CLI + Rust library for checking dependency versions and known
-vulnerabilities. V1 scope is **Rust / Crates.io only**; see [`docs/SCOPE.md`](docs/SCOPE.md)
-for what is deferred and why.
+vulnerabilities. Eleven ecosystems ship — Rust, npm, PyPI, Go, Deno/JSR, pnpm,
+Packagist, pub.dev, NuGet, Hex and Kotlin/Java on Maven Central — with Rust, npm and
+Python marked stable and the rest experimental. The table in
+[`README.md`](README.md) is authoritative for what ships and at what maturity; see
+[`docs/SCOPE.md`](docs/SCOPE.md) for what is deferred and why.
 
 ## Workspace
 
@@ -12,6 +15,10 @@ for what is deferred and why.
   public end-to-end entry point: the `Checker` (parse → fetch → evaluate → OSV scan)
   plus async IO (crates.io sparse index, OSV client, moka cache). Depends on and
   re-exports `dependable-core`, so external consumers (e.g. an IDE) need only this crate.
+- **`dependable-report`** (`crates/dependable-report`) — the report and policy layer:
+  HTML rendering (minijinja), SARIF v2.1.0, the SPDX license evaluator, and the
+  `[policy]` engine. Pure like the core: it takes the finished report model and
+  returns bytes, so it holds no IO of its own. A library only — it ships no binary.
 - **`dependable-tui`** (`crates/dependable-tui`) — the interactive terminal UI
   (ratatui). Holds no IO of its own: it drives `dependable-fetch`. Its `App` state
   machine is free of both IO and ratatui, which is what makes navigation, search,
@@ -21,6 +28,9 @@ for what is deferred and why.
   `tree` command renders the workspace dependency graph offline via
   `dependable_fetch::build_workspace_graph` (no `Checker`, no network).
 
+Five crates, published to crates.io in dependency order:
+core → report → fetch → tui → dependable.
+
 ## Quality
 
 Validate changes before committing:

README.md

@@ -550,6 +550,41 @@ skipped and transitive deps are never fetched), and the public API is
 forward-compatible: enums are `#[non_exhaustive]` and the registry layer routes
 per ecosystem, so future registries (npm, PyPI, Go, …) are additive.
 
+## Exit codes
+
+| Code | Meaning |
+| --- | --- |
+| `0` | The run completed and no armed gate was tripped. |
+| `1` | A gate was tripped: `--fail-on` matched, or a `[policy]` rule was violated. |
+| `2` | The tool could not do the job — a config it cannot read, a policy it cannot enforce, or **a gate it cannot answer**. |
+
+That last case matters for CI. If you arm `--fail-on` (or a `[policy]` severity
+rule) and the run cannot establish what the gate needs — the vulnerability scan did
+not complete, or a registry never answered — `dependable` exits `2` and says so,
+rather than exiting `0`. A gate that reports success on the run it could not perform
+is worse than no gate at all. With no gate armed, an unreachable registry is still
+reported per dependency and the run exits `0`, because nothing was promised.
+
+A registry that *did* answer is a different thing. A package it reports as
+non-existent — an unpublished internal package, one served by a registry this run
+does not route to, a deleted package — is a permanent per-dependency fact, not a
+failure of the run: it appears in the table and in `--format json`, the run says on
+stderr how many were skipped, and the exit code is `0`. The same goes for a
+dependency whose declared version this run could not read, which is reported
+`undetermined`: `--fail-on vulnerable` promises something about vulnerabilities and
+`--fail-on outdated` something about staleness, and neither is a promise that every
+constraint was parseable. `--fail-on any` is that promise, and it fails on both.
+
+Arming a gate the run cannot enforce is a configuration error, caught before any
+network access: `--fail-on vulnerable` with vulnerability scanning switched off
+(`--no-vuln`, or `[vulnerability] enabled = false`) exits `2`, as a `[policy]`
+severity rule already did. Every advisory list would be empty and the gate could
+never fail — a gate is either enforceable or it is a mistake.
+
+`.dependable.toml` is validated: an unknown key or a wrong-typed value is an error,
+not a silent fallback to defaults. One mistyped character used to reset
+`[global] fail_on` to `none` and disarm the gate with nothing on stderr.
+
 ## Development
 
 | Command              | Description                                  |
@@ -568,7 +603,10 @@ per ecosystem, so future registries (npm, PyPI, Go, …) are additive.
 - **`dependable-fetch`** — the high-level library: `Checker` ties parsing to async
   registry + OSV fetching and caching. The public end-to-end entry point for other
   tools; re-exports the core types so consumers need only this crate.
-- **`dependable`** — the CLI binary; a thin wrapper over `dependable-fetch`.
+- **`dependable-report`** — HTML, SARIF, and the `[policy]` engine, over the finished
+  report model. A library only.
+- **`dependable-tui`** — the interactive terminal UI (ratatui), driving `dependable-fetch`.
+- **`dependable`** — the CLI binary; a thin wrapper over the crates above.
 
 ## Git Hooks
 
@@ -583,7 +621,7 @@ is a composite action that installs the released binary and runs the check:
 
 ```yaml
 - uses: actions/checkout@v4
-- uses: getkono/dependable/.github/actions/dependable-check@v0.1.4
+- uses: getkono/dependable/.github/actions/dependable-check@v0.1.3
   with:
     fail-on: vulnerable
 ```
@@ -609,7 +647,7 @@ both the annotations and the job summary. Annotations go to **stderr**, so
 stdout.
 
 This repository's own GitHub Actions workflow runs format checks, linting, and
-tests on pushes to `main` and on pull requests, plus a coverage job that uploads
+tests on pushes to `master` and on pull requests, plus a coverage job that uploads
 an `lcov.info` artifact.
 
 ## License