- SARIFFormatter emits schema-valid SARIF 2.1.0 JSON for CI ingestion - One rule per distinct provider, deduped in first-seen order - Confidence mapped high/medium/low to error/warning/note - startLine floored to 1 per SARIF spec requirement - Registered under name 'sarif' via init()