@0xcraft/powershot 1.1.1 → 1.1.3

package/dist/selftest.js

@@ -31,13 +31,13 @@ import { ProviderError, redact } from './judges/llm.js';
 import { VERIFIERS } from './verifiers/index.js';
 import { existsSync, mkdtempSync, readFileSync, writeFileSync, mkdirSync, readdirSync, rmSync, symlinkSync, realpathSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join, sep } from 'node:path';
+import { dirname, join, sep } from 'node:path';
 import { runTool } from './judges/tools.js';
 import { codeQuality } from './report/codequality.js';
 import { viewer } from './report/viewer.js';
 import { absorbDelegated, delegateBrief } from './delegate.js';
 import { TARGETS, findTarget } from './agents.js';
-import { packFor } from './lang/packs.js';
+import { PACKS, packFor, parseIsolated } from './lang/packs.js';
 import { isPhantom, pythonManifest, localModules } from './lang/python-deps.js';
 import { isPhantomGem, rubyManifest } from './lang/ruby-deps.js';
 import { pyrightAvailable } from './lang/pyright.js';
@@ -48,12 +48,15 @@ import { compact } from './report/compact.js';
 import { apiKey } from './judges/llm.js';
 import { sarif } from './report/sarif.js';
 import { markdown } from './report/markdown.js';
+import { summarizeRun } from './report/summary.js';
 import { wrap } from './report/terminal.js';
 import { highlight, isJsx } from './report/highlight.js';
 import { buildGround, normalizeName, readEnvManifest, relPath } from './ground.js';
 import { incompleteReasons } from './bench.js';
 import { PACKAGE_NAME, PACKAGE_VERSION } from './package-meta.js';
-import { addedLinesFromPatch, createReviewPayload, GitHubPullRequestApi, inlineMarker, parseReviewFindings, reconcileInlineComments, selectInlineComments, syncInlineComments, } from './github/inline-comments.js';
+import { addedLinesFromPatch, inlineMarker, parseReviewFindings, reconcileInlineComments, selectInlineComments, syncInlineComments, } from './github/inline-comments.js';
+import { createReviewPayload, GitHubPullRequestApi, } from './github/api.js';
+import { LEGACY_SUMMARY_MARKER, summaryCommentBody, summaryMarker, syncSummaryComment, workflowCommentScope, } from './github/summary-comment.js';
 const root = '/repo';
 /** Build a Ground by hand so verifiers are testable without git or a real repo. */
 function ground(files, deps = []) {
@@ -433,6 +436,35 @@ check('files are routed to the right language pack', () => {
     assert.equal(packFor('src/a.ts'), undefined); // TypeScript keeps its own oracle
     assert.equal(packFor('README.md'), undefined);
 });
+await checkAsync('isolated trees preserve Unicode offsets and grammar fields', async () => {
+    const pack = PACKS.find((candidate) => candidate.name === 'python');
+    const source = 'label = "é"\ndef answer(value: str) -> str:\n    return value\n';
+    const [tree] = await parseIsolated(pack, [source]);
+    assert.ok(tree);
+    const signature = pack.signatures?.(tree.rootNode).get('answer');
+    assert.ok(signature);
+    assert.equal(signature.node.text, 'def answer(value: str) -> str:\n    return value');
+    assert.deepEqual(signature.params, ['value: str']);
+});
+await checkAsync('language worker batching preserves every file past the 128-file boundary', async () => {
+    const dir = realpathSync(mkdtempSync(join(tmpdir(), 'psh-foreign-batches-')));
+    try {
+        const changes = [];
+        for (let index = 0; index < 129; index++) {
+            const path = 'python/module_' + index + '.py';
+            mkdirSync(dirname(join(dir, path)), { recursive: true });
+            writeFileSync(join(dir, path), 'value = ' + index + '\n');
+            changes.push({ path, added: new Set([1]), before: 'value = -1\n' });
+        }
+        const grounded = await buildGround(dir, changes);
+        assert.equal(grounded.foreign.length, changes.length);
+        assert.deepEqual(grounded.foreign.map((file) => file.path), changes.map((file) => file.path));
+        assert.ok(grounded.foreign.every((file) => file.beforeTree !== undefined));
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
 // Per-language pack checks live in langtest.ts, one process each: eleven wasm
 // grammars cannot share a process without exhausting it. `npm test` runs both.
 console.log('\neditor and provider surface');
@@ -462,7 +494,7 @@ check('compact defaults the column when a finding has no span', () => {
 });
 check('each provider reads its own key', () => {
     const base = { model: 'm', verifiers: ['*'], judges: ['*'], minSeverity: 'low',
-        ignore: [], promptCache: true };
+        ignore: [], coverage: 'portable', promptCache: true };
     const saved = { a: process.env.ANTHROPIC_API_KEY, o: process.env.OPENAI_API_KEY,
         g: process.env.GEMINI_API_KEY, gg: process.env.GOOGLE_API_KEY };
     process.env.ANTHROPIC_API_KEY = 'a';
@@ -555,6 +587,64 @@ check('a review that did not complete never renders as clean', () => {
     });
     assert.match(partial, /partial, not a verdict/);
     assert.match(partial, /outside\.ts \(no types\)/);
+    const partialMarkdown = markdown([], {
+        state: 'partial', notLookedAt: ['outside.ts (no types)'],
+        verifyOnly: true, minSeverity: 'medium', filesReviewed: 4, deterministicChecks: 7,
+    });
+    assert.match(partialMarkdown, /This review is partial — not a verdict/);
+    assert.match(partialMarkdown, /<summary>Why this is not a verdict<\/summary>/);
+    assert.match(partialMarkdown, /4 files reviewed · 7 deterministic checks/);
+    assert.doesNotMatch(partialMarkdown.slice(0, partialMarkdown.indexOf('<details>')), /outside\\?\.ts/);
+    assert.match(partialMarkdown.replace(/\\/g, ''), /outside\.ts \(no types\)/);
+});
+check('portable coverage is a verdict, but never masquerades as full semantic coverage', () => {
+    const unavailable = [
+        '1 reviewed file lacked type information and a reference graph',
+        '2 checks requiring type information or a reference graph did not run: phantom-api, contract-drift',
+    ];
+    const out = terminal([], {
+        subtitle: 'workspace', verified: 0, judged: 0, state: 'complete', notLookedAt: [],
+        coverage: 'portable', verifyOnly: true, minSeverity: 'medium',
+        filesReviewed: 1, deterministicChecks: 1, scopeDetails: unavailable,
+    });
+    assert.match(out, /No medium-or-higher deterministic findings\./);
+    assert.match(out, /1 file reviewed · 1 deterministic check · portable coverage/);
+    assert.match(out, /1 reviewed file lacked type information and a reference graph/);
+    assert.doesNotMatch(out, /not a verdict/);
+    const selected = Array.from({ length: 20 }, (_, index) => ({
+        path: 'web/file-' + index + '.ts',
+        disposition: 'selected',
+        unavailable: index < 11 ? ['types', 'references'] : undefined,
+    }));
+    const waived = Array.from({ length: 16 }, (_, index) => ({
+        path: 'assets/file-' + index + '.json',
+        disposition: 'waived',
+        reason: 'no parser',
+    }));
+    const md = markdown([], summarizeRun({
+        state: 'complete', notLookedAt: [], coverage: 'portable',
+        engine: { verifyOnly: true, minSeverity: 'medium' },
+        files: [...selected, ...waived],
+        checks: {
+            ran: Array.from({ length: 19 }, (_, index) => 'check-' + index),
+            unavailable: [
+                { check: 'phantom-api', missing: 'types' },
+                { check: 'contract-drift', missing: 'references' },
+                { check: 'dead-on-arrival', missing: 'references' },
+            ],
+        },
+    }));
+    assert.match(md, /✅ \*\*No medium-or-higher deterministic findings\*\*/);
+    assert.match(md, /20 files reviewed · 19 deterministic checks · portable coverage/);
+    assert.match(md, /Model review was disabled \(`verify-only`\)\./);
+    assert.match(md, /<summary>Coverage details<\/summary>/);
+    const rendered = md.replace(/\\/g, '');
+    assert.match(rendered, /11 reviewed files? lacked type information and a reference graph/);
+    assert.match(rendered, /3 checks? requiring type information or a reference graph did not run: phantom-api, contract-drift, dead-on-arrival/);
+    assert.match(rendered, /16 changed files? not reviewed: no parser/);
+    assert.ok(md.indexOf('No medium-or-higher deterministic findings') < md.indexOf('Coverage details'));
+    assert.doesNotMatch(md, /web\/file-|assets\/file-/);
+    assert.doesNotMatch(md, /No findings in portable coverage\./);
 });
 check('findings are still shown when a stage failed, with the warning kept', () => {
     const f = { id: 'F1', class: 'verified', check: 'phantom-dep', severity: 'high',
@@ -616,6 +706,23 @@ check('no manifest means nothing to be wrong about', () => {
     assert.equal(pythonManifest('/definitely/not/a/repo'), undefined);
     assert.deepEqual(localModules('/definitely/not/a/repo'), new Set());
 });
+check('local Python modules are discovered from the changed package, not the whole monorepo', () => {
+    const dir = realpathSync(mkdtempSync(join(tmpdir(), 'psh-py-local-')));
+    try {
+        const app = join(dir, 'services', 'api', 'src', 'app.py');
+        mkdirSync(join(dir, 'services', 'api', 'src', 'localpkg'), { recursive: true });
+        mkdirSync(join(dir, 'unrelated', 'hiddenpkg'), { recursive: true });
+        writeFileSync(app, 'from localpkg import value\n');
+        writeFileSync(join(dir, 'services', 'api', 'src', 'localpkg', '__init__.py'), 'value = 1\n');
+        writeFileSync(join(dir, 'unrelated', 'hiddenpkg', '__init__.py'), 'value = 2\n');
+        const local = localModules(dir, dirname(app));
+        assert.equal(local.has('localpkg'), true);
+        assert.equal(local.has('hiddenpkg'), false);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
 console.log('\nruby gems');
 const gems = { names: new Set(['rails', 'httparty', 'sidekiq']) };
 const rbLocal = new Set(['helpers', 'models']);
@@ -654,6 +761,353 @@ const sample = [
     { id: 'F2', class: 'judged', check: 'plausible-logic', severity: 'low', confidence: 'tentative',
         file: 'src/b.ts', line: 9, title: 'off by one' },
 ];
+const summaryHead = 'a'.repeat(40);
+const summaryScope = 'xcrft/powershot/.github/workflows/review.yml:review';
+const ownedSummaryMarker = summaryMarker(summaryScope);
+const renderedSummary = (markdown) => summaryCommentBody(markdown, ownedSummaryMarker, summaryHead);
+check('summary scope follows the workflow file and job, not its moving ref', () => {
+    assert.equal(workflowCommentScope('xcrft/powershot/.github/workflows/review.yml@refs/pull/6/merge', 'review'), summaryScope);
+    assert.equal(workflowCommentScope('xcrft/powershot/.github/workflows/review.yml@refs/heads/release@v1', 'review'), summaryScope);
+});
+await checkAsync('summary publishing creates a marked comment without touching another workflow', async () => {
+    const events = [];
+    const comments = [
+        { id: 8, body: '## PR Analysis', user: { login: 'github-actions[bot]' } },
+        { id: 9, body: ownedSummaryMarker, user: { login: 'human' } },
+    ];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async (body) => {
+            events.push(`create:${body}`);
+            const created = { id: 10, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async (id) => { events.push(`update:${id}`); },
+        deleteIssueComment: async (id) => { events.push(`delete:${id}`); },
+    };
+    const result = await syncSummaryComment(api, '## PowerShot\n\nNo findings.\n', summaryHead, summaryScope);
+    assert.deepEqual(result, { state: 'created', commentId: 10, retired: 0 });
+    assert.deepEqual(events, [`create:${renderedSummary('## PowerShot\n\nNo findings.')}`]);
+});
+await checkAsync('summary reruns update the marked PowerShot comment, not the latest bot comment', async () => {
+    const events = [];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [
+            { id: 10, body: renderedSummary('## PowerShot\n\nOld'), user: { login: 'github-actions[bot]' } },
+            { id: 11, body: '## Best Practices', user: { login: 'github-actions[bot]' } },
+        ],
+        createIssueComment: async () => { throw new Error('must not create'); },
+        updateIssueComment: async (id, body) => { events.push(`update:${id}:${body}`); },
+        deleteIssueComment: async (id) => { events.push(`delete:${id}`); },
+    };
+    const markdown = '## PowerShot\n\nNew';
+    const result = await syncSummaryComment(api, markdown, summaryHead, summaryScope);
+    assert.deepEqual(result, { state: 'updated', commentId: 10, retired: 0 });
+    assert.deepEqual(events, [`update:10:${renderedSummary(markdown)}`]);
+});
+await checkAsync('summary reruns make no write when the marked body is current', async () => {
+    const body = renderedSummary('## PowerShot\n\nCurrent');
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [
+            { id: 10, body, user: { login: 'github-actions[bot]' } },
+            { id: 11, body: '## Best Practices', user: { login: 'github-actions[bot]' } },
+        ],
+        createIssueComment: async () => { throw new Error('must not create'); },
+        updateIssueComment: async () => { throw new Error('must not update'); },
+        deleteIssueComment: async () => { throw new Error('must not delete'); },
+    };
+    assert.deepEqual(await syncSummaryComment(api, '## PowerShot\n\nCurrent', summaryHead, summaryScope), {
+        state: 'unchanged', commentId: 10, retired: 0,
+    });
+});
+await checkAsync('summary publishing migrates the newest legacy PowerShot body once', async () => {
+    const events = [];
+    const comments = [
+        { id: 12, body: LEGACY_SUMMARY_MARKER, user: { login: 'github-actions[bot]' } },
+        { id: 14, body: '## PowerShot\n\nLatest', user: { login: 'github-actions[bot]' } },
+        { id: 15, body: '## PR Analysis', user: { login: 'github-actions[bot]' } },
+    ];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async (body) => {
+            events.push('create');
+            const created = { id: 16, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async () => { throw new Error('legacy comments must not be claimed with PATCH'); },
+        deleteIssueComment: async (id) => {
+            events.push(`delete:${id}`);
+            const index = comments.findIndex((comment) => comment.id === id);
+            if (index !== -1)
+                comments.splice(index, 1);
+        },
+    };
+    const result = await syncSummaryComment(api, '## PowerShot\n\nCurrent', summaryHead, summaryScope);
+    assert.deepEqual(result, { state: 'migrated', commentId: 16, retired: 1 });
+    assert.deepEqual(events, ['create', 'delete:14']);
+    assert.equal(comments.some((comment) => comment.id === 12), true);
+});
+await checkAsync('summary publishing never patches a candidate from another pull request head', async () => {
+    const previousHead = '9'.repeat(40);
+    const comments = [
+        { id: 16, body: summaryCommentBody('old head', ownedSummaryMarker, previousHead), user: { login: 'github-actions[bot]' } },
+    ];
+    const events = [];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async (body) => {
+            events.push('create');
+            const created = { id: 17, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async () => { throw new Error('must not patch a different-head candidate'); },
+        deleteIssueComment: async (id) => {
+            events.push(`delete:${id}`);
+            const index = comments.findIndex((comment) => comment.id === id);
+            if (index !== -1)
+                comments.splice(index, 1);
+        },
+    };
+    assert.deepEqual(await syncSummaryComment(api, 'current head', summaryHead, summaryScope), {
+        state: 'created', commentId: 17, retired: 1,
+    });
+    assert.deepEqual(events, ['create', 'delete:16']);
+    assert.deepEqual(comments.map((comment) => comment.id), [17]);
+});
+await checkAsync('summary ownership requires the marker at the start of the bot comment', async () => {
+    const events = [];
+    const comments = [{
+            id: 16,
+            body: `## PR Analysis\n\nQuoted output: ${ownedSummaryMarker}`,
+            user: { login: 'github-actions[bot]' },
+        }];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async (body) => {
+            events.push('create');
+            const created = { id: 17, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async (id) => { events.push(`update:${id}`); },
+        deleteIssueComment: async (id) => { events.push(`delete:${id}`); },
+    };
+    assert.deepEqual(await syncSummaryComment(api, '## PowerShot\n\nCurrent', summaryHead, summaryScope), {
+        state: 'created', commentId: 17, retired: 0,
+    });
+    assert.deepEqual(events, ['create']);
+});
+await checkAsync('summary markers isolate different workflow jobs using the same bot', async () => {
+    const otherMarker = summaryMarker('xcrft/powershot/.github/workflows/audit.yml:audit');
+    const comments = [
+        {
+            id: 18,
+            body: summaryCommentBody('## PowerShot\n\nAudit', otherMarker, summaryHead),
+            user: { login: 'github-actions[bot]' },
+        },
+    ];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async (body) => {
+            const created = { id: 19, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async () => { throw new Error('must not update another workflow'); },
+        deleteIssueComment: async () => { throw new Error('must not delete another workflow'); },
+    };
+    const result = await syncSummaryComment(api, '## PowerShot\n\nReview', summaryHead, summaryScope);
+    assert.deepEqual(result, { state: 'created', commentId: 19, retired: 0 });
+    assert.equal(comments[0]?.body.includes('Audit'), true);
+});
+await checkAsync('summary publishing makes no writes for an outdated pull request head', async () => {
+    const api = {
+        headSha: async () => 'b'.repeat(40),
+        listIssueComments: async () => { throw new Error('must not list'); },
+        createIssueComment: async () => { throw new Error('must not create'); },
+        updateIssueComment: async () => { throw new Error('must not update'); },
+        deleteIssueComment: async () => { throw new Error('must not delete'); },
+    };
+    assert.deepEqual(await syncSummaryComment(api, 'report', summaryHead, summaryScope), {
+        state: 'outdated', retired: 0,
+    });
+});
+await checkAsync('summary publishing makes no writes when the head changes during reads', async () => {
+    let headReads = 0;
+    const api = {
+        headSha: async () => ++headReads === 1 ? summaryHead : 'b'.repeat(40),
+        listIssueComments: async () => [],
+        createIssueComment: async () => { throw new Error('must not create'); },
+        updateIssueComment: async () => { throw new Error('must not update'); },
+        deleteIssueComment: async () => { throw new Error('must not delete'); },
+    };
+    assert.deepEqual(await syncSummaryComment(api, 'report', summaryHead, summaryScope), {
+        state: 'outdated', retired: 0,
+    });
+});
+await checkAsync('summary publishing retires its own new comment when the head changes after create', async () => {
+    let headReads = 0;
+    const comments = [];
+    const api = {
+        headSha: async () => ++headReads < 3 ? summaryHead : 'b'.repeat(40),
+        listIssueComments: async () => [...comments],
+        createIssueComment: async (body) => {
+            const created = { id: 19, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async () => { throw new Error('must not update'); },
+        deleteIssueComment: async (id) => {
+            const index = comments.findIndex((comment) => comment.id === id);
+            if (index !== -1)
+                comments.splice(index, 1);
+        },
+    };
+    assert.deepEqual(await syncSummaryComment(api, 'report', summaryHead, summaryScope), {
+        state: 'outdated', retired: 1,
+    });
+    assert.deepEqual(comments, []);
+});
+await checkAsync('summary publishing stops after a same-head update when the pull request head changes', async () => {
+    const nextHead = 'b'.repeat(40);
+    let headReads = 0;
+    const oldCandidate = { id: 19, body: renderedSummary('old'), user: { login: 'github-actions[bot]' } };
+    const newCandidate = {
+        id: 20,
+        body: summaryCommentBody('new head', ownedSummaryMarker, nextHead),
+        user: { login: 'github-actions[bot]' },
+    };
+    const comments = [oldCandidate];
+    const api = {
+        headSha: async () => ++headReads < 3 ? summaryHead : nextHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async () => { throw new Error('must not create'); },
+        updateIssueComment: async (id, body) => {
+            assert.equal(id, oldCandidate.id);
+            oldCandidate.body = body;
+            comments.push(newCandidate);
+        },
+        deleteIssueComment: async () => { throw new Error('must not delete after the head changes'); },
+    };
+    assert.deepEqual(await syncSummaryComment(api, 'updated old head', summaryHead, summaryScope), {
+        state: 'outdated', retired: 0,
+    });
+    assert.equal(comments[1]?.body, newCandidate.body);
+});
+await checkAsync('summary reruns retire only older duplicates with the same scoped marker', async () => {
+    const comments = [
+        { id: 20, body: renderedSummary('old'), user: { login: 'github-actions[bot]' } },
+        { id: 21, body: renderedSummary('old'), user: { login: 'github-actions[bot]' } },
+        { id: 22, body: 'human note', user: { login: 'human' } },
+    ];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async () => { throw new Error('must not create'); },
+        updateIssueComment: async (id, body) => {
+            const comment = comments.find((candidate) => candidate.id === id);
+            if (comment)
+                comment.body = body;
+        },
+        deleteIssueComment: async (id) => {
+            const index = comments.findIndex((comment) => comment.id === id);
+            if (index !== -1)
+                comments.splice(index, 1);
+        },
+    };
+    assert.deepEqual(await syncSummaryComment(api, 'current', summaryHead, summaryScope), {
+        state: 'updated', commentId: 21, retired: 1,
+    });
+    assert.deepEqual(comments.map((comment) => comment.id), [21, 22]);
+});
+await checkAsync('concurrent first summary runs converge on one marked comment', async () => {
+    let releaseInitialReads = () => undefined;
+    const initialReads = new Promise((resolve) => { releaseInitialReads = resolve; });
+    let reads = 0;
+    let nextId = 20;
+    const comments = [];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => {
+            if (reads < 2) {
+                const snapshot = [...comments];
+                reads++;
+                if (reads === 2)
+                    releaseInitialReads();
+                await initialReads;
+                return snapshot;
+            }
+            return [...comments];
+        },
+        createIssueComment: async (body) => {
+            const created = { id: nextId++, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async () => { throw new Error('must not update'); },
+        deleteIssueComment: async (id) => {
+            const index = comments.findIndex((comment) => comment.id === id);
+            if (index !== -1)
+                comments.splice(index, 1);
+        },
+    };
+    await Promise.all([
+        syncSummaryComment(api, '## PowerShot\n\nCurrent', summaryHead, summaryScope),
+        syncSummaryComment(api, '## PowerShot\n\nCurrent', summaryHead, summaryScope),
+    ]);
+    assert.equal(comments.filter((comment) => comment.body.startsWith(ownedSummaryMarker)).length, 1);
+});
+await checkAsync('different workflows replace a shared legacy summary without cross-scope PATCH', async () => {
+    let releaseInitialReads = () => undefined;
+    const initialReads = new Promise((resolve) => { releaseInitialReads = resolve; });
+    let reads = 0;
+    let nextId = 31;
+    const legacy = { id: 30, body: '## PowerShot\n\nLegacy', user: { login: 'github-actions[bot]' } };
+    const comments = [legacy];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => {
+            if (reads < 2) {
+                const snapshot = [...comments];
+                reads++;
+                if (reads === 2)
+                    releaseInitialReads();
+                await initialReads;
+                return snapshot;
+            }
+            return [...comments];
+        },
+        createIssueComment: async (body) => {
+            const created = { id: nextId++, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async () => { throw new Error('legacy ownership must not use PATCH'); },
+        deleteIssueComment: async (id) => {
+            const index = comments.findIndex((comment) => comment.id === id);
+            if (index !== -1)
+                comments.splice(index, 1);
+        },
+    };
+    const auditScope = 'xcrft/powershot/.github/workflows/audit.yml:audit';
+    await Promise.all([
+        syncSummaryComment(api, 'review', summaryHead, summaryScope),
+        syncSummaryComment(api, 'audit', summaryHead, auditScope),
+    ]);
+    assert.equal(comments.some((comment) => comment.id === legacy.id), false);
+    assert.equal(comments.filter((comment) => comment.body.startsWith(summaryMarker(summaryScope))).length, 1);
+    assert.equal(comments.filter((comment) => comment.body.startsWith(summaryMarker(auditScope))).length, 1);
+});
 check('GitHub patches expose only added right-side lines for inline comments', () => {
     const patch = [
         '@@ -1,3 +1,4 @@',
@@ -772,10 +1226,20 @@ await checkAsync('the GitHub client paginates files, submits the review contract
                 { id: 10, path: 'a.ts', line: 1, body: 'reply', in_reply_to_id: 9, user: { login: 'human' } },
             ]);
         }
+        if (method === 'GET' && url.includes('/issues/7/comments')) {
+            return json([{ id: 21, body: 'summary', user: { login: 'github-actions[bot]' } }]);
+        }
         if (method === 'POST' && url.endsWith('/pulls/7/reviews'))
             return json({ id: 1 });
+        if (method === 'POST' && url.endsWith('/issues/7/comments')) {
+            return json({ id: 22, body: 'new summary', user: { login: 'github-actions[bot]' } }, { status: 201 });
+        }
+        if (method === 'PATCH' && url.endsWith('/issues/comments/21'))
+            return json({ id: 21 });
         if (method === 'DELETE' && url.endsWith('/pulls/comments/9'))
             return json({ message: 'gone' }, { status: 404 });
+        if (method === 'DELETE' && url.endsWith('/issues/comments/21'))
+            return new Response(undefined, { status: 204 });
         return json({ message: 'unexpected request' }, { status: 500 });
     };
     globalThis.fetch = fakeFetch;
@@ -791,11 +1255,19 @@ await checkAsync('the GitHub client paginates files, submits the review contract
         assert.equal(comments[1]?.inReplyToId, 9);
         await api.createReview('a'.repeat(40), [{ path: 'a.ts', line: 1, side: 'RIGHT', body: 'finding' }]);
         await api.deleteReviewComment(9);
+        assert.deepEqual(await api.listIssueComments(), [
+            { id: 21, body: 'summary', user: { login: 'github-actions[bot]' } },
+        ]);
+        await api.updateIssueComment(21, 'updated summary');
+        assert.deepEqual(await api.createIssueComment('new summary'), {
+            id: 22, body: 'new summary', user: { login: 'github-actions[bot]' },
+        });
+        await api.deleteIssueComment(21);
     }
     finally {
         globalThis.fetch = originalFetch;
     }
-    const submitted = calls.find((call) => call.method === 'POST');
+    const submitted = calls.find((call) => call.method === 'POST' && call.url.endsWith('/pulls/7/reviews'));
     assert.ok(submitted?.body);
     assert.deepEqual(JSON.parse(submitted.body), {
         commit_id: 'a'.repeat(40),
@@ -804,6 +1276,9 @@ await checkAsync('the GitHub client paginates files, submits the review contract
         comments: [{ path: 'a.ts', line: 1, side: 'RIGHT', body: 'finding' }],
     });
     assert.equal(calls.filter((call) => call.url.includes('/files')).length, 2);
+    assert.equal(calls.some((call) => call.method === 'PATCH' && call.url.endsWith('/issues/comments/21') && call.body === '{"body":"updated summary"}'), true);
+    assert.equal(calls.some((call) => call.method === 'POST' && call.url.endsWith('/issues/7/comments') && call.body === '{"body":"new summary"}'), true);
+    assert.equal(calls.some((call) => call.method === 'DELETE' && call.url.endsWith('/issues/comments/21')), true);
 });
 await checkAsync('inline synchronization creates one review before removing stale comments', async () => {
     const finding = {
@@ -892,7 +1367,7 @@ check('self-review publishes machine findings only for a complete verdict', () =
     const workflow = readFileSync(join(process.cwd(), '.github', 'workflows', 'review.yml'), 'utf8');
     assert.equal(workflow.match(/node "\$PSH" review/g)?.length, 1);
     assert.match(workflow, /name: Check out the untrusted review target[\s\S]+allow-unsafe-pr-checkout: true/);
-    assert.match(workflow, /name: Install the target type environment[\s\S]+working-directory: target[\s\S]+npm ci --ignore-scripts/);
+    assert.doesNotMatch(workflow, /working-directory: target[\s\S]{0,120}npm ci/);
     assert.match(workflow, /steps\.review\.outputs\.status == '0' \|\| steps\.review\.outputs\.status == '1'/);
     assert.match(workflow, /sarif_file: powershot\.sarif\s+checkout_path: target\s+ref: refs\/pull\/\$\{\{ github\.event\.pull_request\.number \}\}\/head\s+sha: \$\{\{ github\.event\.pull_request\.head\.sha \}\}/);
 });
@@ -906,6 +1381,15 @@ check('the public action persists judge answers and publishes only a verdict', (
     assert.match(action, /inline-comments:\s*\n\s+description: [^\n]+\n\s+default: 'false'/);
     assert.match(action, /Post inline comments[\s\S]+inputs\.inline-comments == 'true'[\s\S]+steps\.review\.outputs\.complete == 'true'/);
     assert.match(action, /node "\$GITHUB_ACTION_PATH\/dist\/github\/inline-comments\.js"/);
+    assert.doesNotMatch(action, /--edit-last/);
+    assert.match(action, /node "\$GITHUB_ACTION_PATH\/dist\/github\/summary-comment\.js"/);
+    assert.match(action, /POWERSHOT_HEAD_SHA: \$\{\{ github\.event\.pull_request\.head\.sha \}\}/);
+    assert.match(action, /GITHUB_WORKFLOW_REF: \$\{\{ github\.workflow_ref \}\}/);
+    assert.match(action, /GITHUB_JOB: \$\{\{ github\.job \}\}/);
+    assert.match(action, /--report manifest=powershot\.manifest\.json/);
+    assert.match(action, /coverage=\$COVERAGE/);
+    assert.match(action, /m\.coverage === "full" \|\| m\.coverage === "portable" \? m\.coverage : "unknown"/);
+    assert.match(action, /Approve a clean review[\s\S]+steps\.review\.outputs\.coverage == 'full'/);
 });
 check('published CI examples preserve one verdict and its exit status', () => {
     const action = readFileSync(join(process.cwd(), 'examples', 'github-actions', 'action.yml'), 'utf8');
@@ -914,12 +1398,14 @@ check('published CI examples preserve one verdict and its exit status', () => {
     assert.match(action, /upload-sarif: 'true'/);
     assert.match(action, /inline-comments: 'true'/);
     assert.match(action, /runs-on: ubuntu-24\.04/);
-    assert.match(action, /npm ci --ignore-scripts[\s\S]+uses: xcrft\/powershot@v1/);
-    assert.match(github, /npm install --global --ignore-scripts @0xcraft\/powershot@1\.1\.1/);
+    assert.match(action, /concurrency:[\s\S]+github\.workflow[\s\S]+cancel-in-progress: true/);
+    assert.doesNotMatch(action, /npm ci|NPM_AUTH_TOKEN|NODE_AUTH_TOKEN/);
+    assert.match(action, /uses: xcrft\/powershot@v1/);
+    assert.match(github, /npm install --global --ignore-scripts @0xcraft\/powershot@1\.1\.2/);
     assert.equal(github.match(/psh review/g)?.length, 1);
     assert.match(github, /--report markdown=powershot\.md[\s\S]+--report sarif=powershot\.sarif/);
     assert.match(github, /\|\| STATUS=\$\?[\s\S]+case "\$STATUS"/);
-    assert.match(gitlab, /npm install --global --ignore-scripts @0xcraft\/powershot@1\.1\.1/);
+    assert.match(gitlab, /npm install --global --ignore-scripts @0xcraft\/powershot@1\.1\.2/);
     assert.equal(gitlab.match(/psh review/g)?.length, 1);
     assert.match(gitlab, /--format codequality > gl-code-quality-report\.json \|\| STATUS=\$\?/);
     assert.match(gitlab, /test "\$STATUS" -le 1 \|\| exit "\$STATUS"/);
@@ -940,6 +1426,17 @@ check('the viewer is one self-contained page', () => {
     assert.equal(/<(script|link|img)[^>]+(src|href)="http/.test(html), false); // no network needed
     assert.equal((html.match(/class="f /g) ?? []).length, 2);
 });
+check('the viewer labels a complete portable session', () => {
+    const html = viewer([], {
+        id: 'portable', target: 'workspace', started: '2026-01-01T10:00:00Z',
+        state: 'complete', notLookedAt: [], coverage: 'portable',
+        verifyOnly: true, minSeverity: 'medium', filesReviewed: 1, deterministicChecks: 2,
+        scopeDetails: ['1 reviewed file lacked type information'],
+    });
+    assert.match(html, /1 file reviewed · 2 deterministic checks · portable coverage/);
+    assert.match(html, /No medium-or-higher deterministic findings\./);
+    assert.match(html, /<summary>Coverage details<\/summary>/);
+});
 check('the viewer escapes content rather than rendering it', () => {
     const nasty = [{ ...sample[0], title: '<img src=x onerror=alert(1)>' }];
     const html = viewer(nasty, {
@@ -967,7 +1464,7 @@ check('delegated output distinguishes an empty verdict from malformed data', ()
 check('delegate --checks selects only the requested judging brief', () => {
     const cfg = {
         provider: 'anthropic', model: 'm', verifiers: ['*'], judges: ['*'],
-        minSeverity: 'low', ignore: [], promptCache: true,
+        minSeverity: 'low', ignore: [], coverage: 'portable', promptCache: true,
     };
     const brief = delegateBrief(ground([{ path: 'a.ts', after: 'export const a = 1\n' }]), cfg, {
         checks: ['intent'], intent: 'add a',
@@ -1736,6 +2233,12 @@ check('judges accept both the plain list and the { enable } form', () => {
     assert.equal(validateConfig({ judges: { enable: ['securty'] } }, KNOWN).length, 1);
     assert.equal(validateConfig({ judges: 'security' }, KNOWN).length, 1); // not a list at all
 });
+check('coverage is portable by default and strict only when requested', () => {
+    assert.equal(loadConfig(process.cwd()).coverage, 'portable');
+    assert.deepEqual(validateConfig({ coverage: 'portable' }, KNOWN), []);
+    assert.deepEqual(validateConfig({ coverage: 'strict' }, KNOWN), []);
+    assert.match(validateConfig({ coverage: 'complete' }, KNOWN)[0], /not one of: portable, strict/);
+});
 console.log('\nsession safety');
 check('a session will not be resumed by a different model than answered it', () => {
     const dir = mkdtempSync(join(tmpdir(), 'psh-ses-'));
@@ -1997,6 +2500,32 @@ check('the manifest accounts for everything it selected', () => {
     // and a failure anywhere means the run is not a verdict
     assert.equal(m2.build({ ...base, failures: ['judge died'] }).state, 'failed');
 });
+check('portable oracle gaps stay visible without turning the run into a partial verdict', () => {
+    const manifest = new RunManifest('portable');
+    manifest.ran('swallowed-error');
+    const record = manifest.build({
+        operation: 'review', target: { requested: {} },
+        policy: { source: 'base', hash: 'h' },
+        engine: { version: '0', tools: false, verifyOnly: true },
+        files: [{
+                path: 'web/app.ts', disposition: 'selected', bytes: 1, addedLines: 1,
+                language: 'typescript', checks: ['swallowed-error'], unavailable: ['types', 'references'],
+            }],
+        skippedChecks: [],
+        unavailableChecks: [
+            { check: 'phantom-api', missing: 'types' },
+            { check: 'contract-drift', missing: 'references' },
+        ],
+        findings: { total: 0, verified: 0, judged: 0, dismissed: 0, droppedPosition: 0 },
+        usage: { requests: 0, inputTokens: 0, outputTokens: 0, toolCalls: 0, elapsedMs: 0, units: 0 },
+        failures: [],
+    });
+    assert.equal(record.state, 'complete');
+    assert.deepEqual(record.notLookedAt, []);
+    assert.deepEqual(record.files[0].unavailable, ['types', 'references']);
+    assert.equal(record.checks.unavailable?.length, 2);
+    assert.deepEqual(coverageProblems(record), []);
+});
 check('a manifest that hides an unreached unit is caught as our bug', () => {
     const broken = {
         schema: SCHEMA, id: 'x', operation: 'review', started: '', ended: '',
@@ -2145,6 +2674,7 @@ await checkAsync('per-file limits follow the checks the caller actually selected
             operation: 'scan', target: { requested: {} }, policy: { source: 'default', hash: 'h' },
             engine: { version: '0', tools: false, verifyOnly: true }, files: result.plan?.items() ?? [],
             skippedChecks: result.skippedChecks ?? [],
+            unavailableChecks: result.unavailableChecks ?? [],
             findings: { total: result.findings.length, verified: result.stats.verified, judged: result.stats.judged,
                 dismissed: result.stats.dismissed, droppedPosition: 0 },
             usage: result.usage, failures: result.failures,
@@ -2162,6 +2692,131 @@ await checkAsync('per-file limits follow the checks the caller actually selected
         rmSync(dir, { recursive: true, force: true });
     }
 });
+await checkAsync('portable coverage reviews every declared language together without repository installs', async () => {
+    const dir = realpathSync(mkdtempSync(join(tmpdir(), 'psh-portable-mixed-')));
+    try {
+        const sources = {
+            python: { path: 'services/api/app.py', source: 'def answer() -> int:\n    try:\n        risky()\n    except Exception:\n        pass\n    return 42\n' },
+            go: { path: 'services/agent/main.go', source: 'package agent\nfunc answer() int {\n  if err := risky(); err != nil {\n  }\n  return 42\n}\n' },
+            java: { path: 'services/jvm/App.java', source: 'class App { int answer() { try { risky(); } catch (Exception e) { } return 42; } }\n' },
+            rust: { path: 'crates/worker/src/lib.rs', source: 'pub fn answer() -> i32 { match risky() { Err(_) => {}, Ok(v) => v }; 42 }\n' },
+            cpp: { path: 'native/app.cpp', source: 'int answer() { try { risky(); } catch (...) { } return 42; }\n' },
+            c: { path: 'native/app.c', source: 'int answer(void) { return 42; }\n' },
+            'c#': { path: 'dotnet/App.cs', source: 'class App { int Answer() { try { Risky(); } catch (Exception e) { } return 42; } }\n' },
+            php: { path: 'php/app.php', source: '<?php function answer() { try { risky(); } catch (Exception $e) { } return 42; }\n' },
+            kotlin: { path: 'android/App.kt', source: 'fun answer(): Int { try { risky() } catch (e: Exception) {} ; return 42 }\n' },
+            ruby: { path: 'ruby/app.rb', source: 'def answer\n  begin\n    risky\n  rescue => e\n  end\n  42\nend\n' },
+            solidity: { path: 'contracts/App.sol', source: 'contract App { function answer() public returns (uint) { try this.risky() { } catch { } return 42; } function risky() external {} }\n' },
+        };
+        assert.deepEqual(Object.keys(sources).sort(), PACKS.map((pack) => pack.name).sort());
+        const native = [
+            { path: 'web/app.ts', source: 'export const answer = 42\n' },
+            { path: 'web/legacy.js', source: 'export const legacyAnswer = 42\n' },
+        ];
+        const all = [...native, ...Object.values(sources)];
+        for (const file of all) {
+            mkdirSync(dirname(join(dir, file.path)), { recursive: true });
+            writeFileSync(join(dir, file.path), file.source);
+        }
+        const changes = all.map((file) => ({
+            path: file.path,
+            added: new Set(file.source.split('\n').slice(0, -1).map((_, line) => line + 1)),
+            before: file.source.replace('42', '41'),
+        }));
+        const manifest = new RunManifest('portable-mixed');
+        const result = await review({
+            root: dir, range: {}, changes, config: loadConfig(dir), verifyOnly: true, manifest,
+        });
+        const record = manifest.build({
+            operation: 'review', target: { requested: {} }, policy: { source: 'default', hash: 'h' },
+            engine: { version: '0', tools: false, verifyOnly: true }, files: result.plan.items(),
+            skippedChecks: result.skippedChecks ?? [], unavailableChecks: result.unavailableChecks ?? [],
+            findings: { total: result.findings.length, verified: result.stats.verified, judged: result.stats.judged,
+                dismissed: result.stats.dismissed, droppedPosition: result.droppedPosition ?? 0 },
+            usage: result.usage, failures: result.failures,
+        });
+        assert.equal(record.state, 'complete');
+        assert.deepEqual(record.notLookedAt, []);
+        assert.equal(record.files.length, all.length);
+        assert.ok(record.files.every((file) => file.disposition === 'selected'), 'a declared language cannot be waived');
+        assert.ok(record.files.every((file) => file.checks.length > 0), 'every declared language needs baseline checks');
+        const swallowed = new Set(result.findings.filter((finding) => finding.check === 'swallowed-error').map((finding) => finding.file));
+        for (const [language, file] of Object.entries(sources)) {
+            if (language !== 'c')
+                assert.equal(swallowed.has(file.path), true, language + ' isolated AST must drive its oracle');
+        }
+        assert.deepEqual(record.files.find((file) => file.path === 'web/app.ts')?.unavailable, ['types', 'references']);
+        assert.ok(record.checks.unavailable?.some((check) => check.check === 'phantom-api' && check.missing === 'types'));
+        assert.deepEqual(coverageProblems(record), []);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+await checkAsync('strict coverage keeps missing semantic oracles verdict-blocking', async () => {
+    const dir = realpathSync(mkdtempSync(join(tmpdir(), 'psh-strict-')));
+    try {
+        writeFileSync(join(dir, 'app.ts'), 'export const answer = 42\n');
+        const manifest = new RunManifest('strict');
+        const result = await review({
+            root: dir,
+            range: {},
+            changes: [{ path: 'app.ts', added: new Set([1]), before: 'export const answer = 41\n' }],
+            config: { ...loadConfig(dir), coverage: 'strict' },
+            verifyOnly: true,
+            manifest,
+        });
+        const record = manifest.build({
+            operation: 'review', target: { requested: {} }, policy: { source: 'default', hash: 'h' },
+            engine: { version: '0', tools: false, verifyOnly: true }, files: result.plan.items(),
+            skippedChecks: result.skippedChecks ?? [], unavailableChecks: result.unavailableChecks ?? [],
+            findings: { total: result.findings.length, verified: result.stats.verified, judged: result.stats.judged,
+                dismissed: result.stats.dismissed, droppedPosition: result.droppedPosition ?? 0 },
+            usage: result.usage, failures: result.failures,
+        });
+        assert.equal(record.state, 'partial');
+        assert.deepEqual(record.files[0].missing, ['types', 'references']);
+        assert.deepEqual(record.files[0].unavailable, undefined);
+        assert.ok(record.checks.skipped.some((check) => check.check === 'phantom-api' && check.missing === 'types'));
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+await checkAsync('portable coverage still blocks when an existing foreign base cannot be parsed', async () => {
+    const dir = realpathSync(mkdtempSync(join(tmpdir(), 'psh-foreign-base-limit-')));
+    try {
+        writeFileSync(join(dir, 'app.py'), 'def answer():\n    return 42\n');
+        const manifest = new RunManifest('foreign-base-limit');
+        const result = await review({
+            root: dir,
+            range: {},
+            changes: [{
+                    path: 'app.py',
+                    added: new Set([1, 2]),
+                    before: 'value = 1\n'.repeat(60_000),
+                }],
+            config: loadConfig(dir),
+            verifyOnly: true,
+            manifest,
+        });
+        const record = manifest.build({
+            operation: 'review', target: { requested: {} }, policy: { source: 'default', hash: 'h' },
+            engine: { version: '0', tools: false, verifyOnly: true }, files: result.plan.items(),
+            skippedChecks: result.skippedChecks ?? [], unavailableChecks: result.unavailableChecks ?? [],
+            findings: { total: result.findings.length, verified: result.stats.verified, judged: result.stats.judged,
+                dismissed: result.stats.dismissed, droppedPosition: result.droppedPosition ?? 0 },
+            usage: result.usage, failures: result.failures,
+        });
+        assert.equal(record.state, 'partial');
+        assert.ok(record.files[0].missing?.includes('base'));
+        assert.ok(record.checks.skipped.some((check) => check.missing.includes('base')));
+        assert.deepEqual(coverageProblems(record), []);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
 await checkAsync('foreign checks advertise only files their language pack can inspect', async () => {
     const dir = realpathSync(mkdtempSync(join(tmpdir(), 'psh-pack-coverage-')));
     try {