@0xcraft/powershot 1.1.2 → 1.1.3

package/dist/selftest.js

@@ -48,12 +48,15 @@ import { compact } from './report/compact.js';
 import { apiKey } from './judges/llm.js';
 import { sarif } from './report/sarif.js';
 import { markdown } from './report/markdown.js';
+import { summarizeRun } from './report/summary.js';
 import { wrap } from './report/terminal.js';
 import { highlight, isJsx } from './report/highlight.js';
 import { buildGround, normalizeName, readEnvManifest, relPath } from './ground.js';
 import { incompleteReasons } from './bench.js';
 import { PACKAGE_NAME, PACKAGE_VERSION } from './package-meta.js';
-import { addedLinesFromPatch, createReviewPayload, GitHubPullRequestApi, inlineMarker, parseReviewFindings, reconcileInlineComments, selectInlineComments, syncInlineComments, } from './github/inline-comments.js';
+import { addedLinesFromPatch, inlineMarker, parseReviewFindings, reconcileInlineComments, selectInlineComments, syncInlineComments, } from './github/inline-comments.js';
+import { createReviewPayload, GitHubPullRequestApi, } from './github/api.js';
+import { LEGACY_SUMMARY_MARKER, summaryCommentBody, summaryMarker, syncSummaryComment, workflowCommentScope, } from './github/summary-comment.js';
 const root = '/repo';
 /** Build a Ground by hand so verifiers are testable without git or a real repo. */
 function ground(files, deps = []) {
@@ -584,30 +587,64 @@ check('a review that did not complete never renders as clean', () => {
     });
     assert.match(partial, /partial, not a verdict/);
     assert.match(partial, /outside\.ts \(no types\)/);
+    const partialMarkdown = markdown([], {
+        state: 'partial', notLookedAt: ['outside.ts (no types)'],
+        verifyOnly: true, minSeverity: 'medium', filesReviewed: 4, deterministicChecks: 7,
+    });
+    assert.match(partialMarkdown, /This review is partial — not a verdict/);
+    assert.match(partialMarkdown, /<summary>Why this is not a verdict<\/summary>/);
+    assert.match(partialMarkdown, /4 files reviewed · 7 deterministic checks/);
+    assert.doesNotMatch(partialMarkdown.slice(0, partialMarkdown.indexOf('<details>')), /outside\\?\.ts/);
+    assert.match(partialMarkdown.replace(/\\/g, ''), /outside\.ts \(no types\)/);
 });
 check('portable coverage is a verdict, but never masquerades as full semantic coverage', () => {
     const unavailable = [
-        '1 file(s) without enriched semantic coverage: web/app.ts (types, references)',
-        '2 enriched check(s) unavailable: phantom-api (no types), contract-drift (no references)',
+        '1 reviewed file lacked type information and a reference graph',
+        '2 checks requiring type information or a reference graph did not run: phantom-api, contract-drift',
     ];
     const out = terminal([], {
         subtitle: 'workspace', verified: 0, judged: 0, state: 'complete', notLookedAt: [],
-        coverage: 'portable', unavailableCoverage: unavailable,
+        coverage: 'portable', verifyOnly: true, minSeverity: 'medium',
+        filesReviewed: 1, deterministicChecks: 1, scopeDetails: unavailable,
     });
-    assert.match(out, /No findings in portable coverage\./);
-    assert.match(out, /web\/app\.ts \(types, references\)/);
+    assert.match(out, /No medium-or-higher deterministic findings\./);
+    assert.match(out, /1 file reviewed · 1 deterministic check · portable coverage/);
+    assert.match(out, /1 reviewed file lacked type information and a reference graph/);
     assert.doesNotMatch(out, /not a verdict/);
-    const md = markdown([], {
+    const selected = Array.from({ length: 20 }, (_, index) => ({
+        path: 'web/file-' + index + '.ts',
+        disposition: 'selected',
+        unavailable: index < 11 ? ['types', 'references'] : undefined,
+    }));
+    const waived = Array.from({ length: 16 }, (_, index) => ({
+        path: 'assets/file-' + index + '.json',
+        disposition: 'waived',
+        reason: 'no parser',
+    }));
+    const md = markdown([], summarizeRun({
         state: 'complete', notLookedAt: [], coverage: 'portable',
-        files: [{ path: 'web/app.ts', unavailable: ['types', 'references'] }],
-        checks: { unavailable: [
+        engine: { verifyOnly: true, minSeverity: 'medium' },
+        files: [...selected, ...waived],
+        checks: {
+            ran: Array.from({ length: 19 }, (_, index) => 'check-' + index),
+            unavailable: [
                 { check: 'phantom-api', missing: 'types' },
                 { check: 'contract-drift', missing: 'references' },
-            ] },
-    });
-    assert.match(md, /\*\*Portable coverage\.\*\*/);
-    assert.match(md, /No findings in portable coverage\./);
-    assert.doesNotMatch(md, /^No findings\.$/m);
+                { check: 'dead-on-arrival', missing: 'references' },
+            ],
+        },
+    }));
+    assert.match(md, /✅ \*\*No medium-or-higher deterministic findings\*\*/);
+    assert.match(md, /20 files reviewed · 19 deterministic checks · portable coverage/);
+    assert.match(md, /Model review was disabled \(`verify-only`\)\./);
+    assert.match(md, /<summary>Coverage details<\/summary>/);
+    const rendered = md.replace(/\\/g, '');
+    assert.match(rendered, /11 reviewed files? lacked type information and a reference graph/);
+    assert.match(rendered, /3 checks? requiring type information or a reference graph did not run: phantom-api, contract-drift, dead-on-arrival/);
+    assert.match(rendered, /16 changed files? not reviewed: no parser/);
+    assert.ok(md.indexOf('No medium-or-higher deterministic findings') < md.indexOf('Coverage details'));
+    assert.doesNotMatch(md, /web\/file-|assets\/file-/);
+    assert.doesNotMatch(md, /No findings in portable coverage\./);
 });
 check('findings are still shown when a stage failed, with the warning kept', () => {
     const f = { id: 'F1', class: 'verified', check: 'phantom-dep', severity: 'high',
@@ -724,6 +761,353 @@ const sample = [
     { id: 'F2', class: 'judged', check: 'plausible-logic', severity: 'low', confidence: 'tentative',
         file: 'src/b.ts', line: 9, title: 'off by one' },
 ];
+const summaryHead = 'a'.repeat(40);
+const summaryScope = 'xcrft/powershot/.github/workflows/review.yml:review';
+const ownedSummaryMarker = summaryMarker(summaryScope);
+const renderedSummary = (markdown) => summaryCommentBody(markdown, ownedSummaryMarker, summaryHead);
+check('summary scope follows the workflow file and job, not its moving ref', () => {
+    assert.equal(workflowCommentScope('xcrft/powershot/.github/workflows/review.yml@refs/pull/6/merge', 'review'), summaryScope);
+    assert.equal(workflowCommentScope('xcrft/powershot/.github/workflows/review.yml@refs/heads/release@v1', 'review'), summaryScope);
+});
+await checkAsync('summary publishing creates a marked comment without touching another workflow', async () => {
+    const events = [];
+    const comments = [
+        { id: 8, body: '## PR Analysis', user: { login: 'github-actions[bot]' } },
+        { id: 9, body: ownedSummaryMarker, user: { login: 'human' } },
+    ];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async (body) => {
+            events.push(`create:${body}`);
+            const created = { id: 10, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async (id) => { events.push(`update:${id}`); },
+        deleteIssueComment: async (id) => { events.push(`delete:${id}`); },
+    };
+    const result = await syncSummaryComment(api, '## PowerShot\n\nNo findings.\n', summaryHead, summaryScope);
+    assert.deepEqual(result, { state: 'created', commentId: 10, retired: 0 });
+    assert.deepEqual(events, [`create:${renderedSummary('## PowerShot\n\nNo findings.')}`]);
+});
+await checkAsync('summary reruns update the marked PowerShot comment, not the latest bot comment', async () => {
+    const events = [];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [
+            { id: 10, body: renderedSummary('## PowerShot\n\nOld'), user: { login: 'github-actions[bot]' } },
+            { id: 11, body: '## Best Practices', user: { login: 'github-actions[bot]' } },
+        ],
+        createIssueComment: async () => { throw new Error('must not create'); },
+        updateIssueComment: async (id, body) => { events.push(`update:${id}:${body}`); },
+        deleteIssueComment: async (id) => { events.push(`delete:${id}`); },
+    };
+    const markdown = '## PowerShot\n\nNew';
+    const result = await syncSummaryComment(api, markdown, summaryHead, summaryScope);
+    assert.deepEqual(result, { state: 'updated', commentId: 10, retired: 0 });
+    assert.deepEqual(events, [`update:10:${renderedSummary(markdown)}`]);
+});
+await checkAsync('summary reruns make no write when the marked body is current', async () => {
+    const body = renderedSummary('## PowerShot\n\nCurrent');
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [
+            { id: 10, body, user: { login: 'github-actions[bot]' } },
+            { id: 11, body: '## Best Practices', user: { login: 'github-actions[bot]' } },
+        ],
+        createIssueComment: async () => { throw new Error('must not create'); },
+        updateIssueComment: async () => { throw new Error('must not update'); },
+        deleteIssueComment: async () => { throw new Error('must not delete'); },
+    };
+    assert.deepEqual(await syncSummaryComment(api, '## PowerShot\n\nCurrent', summaryHead, summaryScope), {
+        state: 'unchanged', commentId: 10, retired: 0,
+    });
+});
+await checkAsync('summary publishing migrates the newest legacy PowerShot body once', async () => {
+    const events = [];
+    const comments = [
+        { id: 12, body: LEGACY_SUMMARY_MARKER, user: { login: 'github-actions[bot]' } },
+        { id: 14, body: '## PowerShot\n\nLatest', user: { login: 'github-actions[bot]' } },
+        { id: 15, body: '## PR Analysis', user: { login: 'github-actions[bot]' } },
+    ];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async (body) => {
+            events.push('create');
+            const created = { id: 16, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async () => { throw new Error('legacy comments must not be claimed with PATCH'); },
+        deleteIssueComment: async (id) => {
+            events.push(`delete:${id}`);
+            const index = comments.findIndex((comment) => comment.id === id);
+            if (index !== -1)
+                comments.splice(index, 1);
+        },
+    };
+    const result = await syncSummaryComment(api, '## PowerShot\n\nCurrent', summaryHead, summaryScope);
+    assert.deepEqual(result, { state: 'migrated', commentId: 16, retired: 1 });
+    assert.deepEqual(events, ['create', 'delete:14']);
+    assert.equal(comments.some((comment) => comment.id === 12), true);
+});
+await checkAsync('summary publishing never patches a candidate from another pull request head', async () => {
+    const previousHead = '9'.repeat(40);
+    const comments = [
+        { id: 16, body: summaryCommentBody('old head', ownedSummaryMarker, previousHead), user: { login: 'github-actions[bot]' } },
+    ];
+    const events = [];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async (body) => {
+            events.push('create');
+            const created = { id: 17, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async () => { throw new Error('must not patch a different-head candidate'); },
+        deleteIssueComment: async (id) => {
+            events.push(`delete:${id}`);
+            const index = comments.findIndex((comment) => comment.id === id);
+            if (index !== -1)
+                comments.splice(index, 1);
+        },
+    };
+    assert.deepEqual(await syncSummaryComment(api, 'current head', summaryHead, summaryScope), {
+        state: 'created', commentId: 17, retired: 1,
+    });
+    assert.deepEqual(events, ['create', 'delete:16']);
+    assert.deepEqual(comments.map((comment) => comment.id), [17]);
+});
+await checkAsync('summary ownership requires the marker at the start of the bot comment', async () => {
+    const events = [];
+    const comments = [{
+            id: 16,
+            body: `## PR Analysis\n\nQuoted output: ${ownedSummaryMarker}`,
+            user: { login: 'github-actions[bot]' },
+        }];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async (body) => {
+            events.push('create');
+            const created = { id: 17, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async (id) => { events.push(`update:${id}`); },
+        deleteIssueComment: async (id) => { events.push(`delete:${id}`); },
+    };
+    assert.deepEqual(await syncSummaryComment(api, '## PowerShot\n\nCurrent', summaryHead, summaryScope), {
+        state: 'created', commentId: 17, retired: 0,
+    });
+    assert.deepEqual(events, ['create']);
+});
+await checkAsync('summary markers isolate different workflow jobs using the same bot', async () => {
+    const otherMarker = summaryMarker('xcrft/powershot/.github/workflows/audit.yml:audit');
+    const comments = [
+        {
+            id: 18,
+            body: summaryCommentBody('## PowerShot\n\nAudit', otherMarker, summaryHead),
+            user: { login: 'github-actions[bot]' },
+        },
+    ];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async (body) => {
+            const created = { id: 19, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async () => { throw new Error('must not update another workflow'); },
+        deleteIssueComment: async () => { throw new Error('must not delete another workflow'); },
+    };
+    const result = await syncSummaryComment(api, '## PowerShot\n\nReview', summaryHead, summaryScope);
+    assert.deepEqual(result, { state: 'created', commentId: 19, retired: 0 });
+    assert.equal(comments[0]?.body.includes('Audit'), true);
+});
+await checkAsync('summary publishing makes no writes for an outdated pull request head', async () => {
+    const api = {
+        headSha: async () => 'b'.repeat(40),
+        listIssueComments: async () => { throw new Error('must not list'); },
+        createIssueComment: async () => { throw new Error('must not create'); },
+        updateIssueComment: async () => { throw new Error('must not update'); },
+        deleteIssueComment: async () => { throw new Error('must not delete'); },
+    };
+    assert.deepEqual(await syncSummaryComment(api, 'report', summaryHead, summaryScope), {
+        state: 'outdated', retired: 0,
+    });
+});
+await checkAsync('summary publishing makes no writes when the head changes during reads', async () => {
+    let headReads = 0;
+    const api = {
+        headSha: async () => ++headReads === 1 ? summaryHead : 'b'.repeat(40),
+        listIssueComments: async () => [],
+        createIssueComment: async () => { throw new Error('must not create'); },
+        updateIssueComment: async () => { throw new Error('must not update'); },
+        deleteIssueComment: async () => { throw new Error('must not delete'); },
+    };
+    assert.deepEqual(await syncSummaryComment(api, 'report', summaryHead, summaryScope), {
+        state: 'outdated', retired: 0,
+    });
+});
+await checkAsync('summary publishing retires its own new comment when the head changes after create', async () => {
+    let headReads = 0;
+    const comments = [];
+    const api = {
+        headSha: async () => ++headReads < 3 ? summaryHead : 'b'.repeat(40),
+        listIssueComments: async () => [...comments],
+        createIssueComment: async (body) => {
+            const created = { id: 19, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async () => { throw new Error('must not update'); },
+        deleteIssueComment: async (id) => {
+            const index = comments.findIndex((comment) => comment.id === id);
+            if (index !== -1)
+                comments.splice(index, 1);
+        },
+    };
+    assert.deepEqual(await syncSummaryComment(api, 'report', summaryHead, summaryScope), {
+        state: 'outdated', retired: 1,
+    });
+    assert.deepEqual(comments, []);
+});
+await checkAsync('summary publishing stops after a same-head update when the pull request head changes', async () => {
+    const nextHead = 'b'.repeat(40);
+    let headReads = 0;
+    const oldCandidate = { id: 19, body: renderedSummary('old'), user: { login: 'github-actions[bot]' } };
+    const newCandidate = {
+        id: 20,
+        body: summaryCommentBody('new head', ownedSummaryMarker, nextHead),
+        user: { login: 'github-actions[bot]' },
+    };
+    const comments = [oldCandidate];
+    const api = {
+        headSha: async () => ++headReads < 3 ? summaryHead : nextHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async () => { throw new Error('must not create'); },
+        updateIssueComment: async (id, body) => {
+            assert.equal(id, oldCandidate.id);
+            oldCandidate.body = body;
+            comments.push(newCandidate);
+        },
+        deleteIssueComment: async () => { throw new Error('must not delete after the head changes'); },
+    };
+    assert.deepEqual(await syncSummaryComment(api, 'updated old head', summaryHead, summaryScope), {
+        state: 'outdated', retired: 0,
+    });
+    assert.equal(comments[1]?.body, newCandidate.body);
+});
+await checkAsync('summary reruns retire only older duplicates with the same scoped marker', async () => {
+    const comments = [
+        { id: 20, body: renderedSummary('old'), user: { login: 'github-actions[bot]' } },
+        { id: 21, body: renderedSummary('old'), user: { login: 'github-actions[bot]' } },
+        { id: 22, body: 'human note', user: { login: 'human' } },
+    ];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async () => { throw new Error('must not create'); },
+        updateIssueComment: async (id, body) => {
+            const comment = comments.find((candidate) => candidate.id === id);
+            if (comment)
+                comment.body = body;
+        },
+        deleteIssueComment: async (id) => {
+            const index = comments.findIndex((comment) => comment.id === id);
+            if (index !== -1)
+                comments.splice(index, 1);
+        },
+    };
+    assert.deepEqual(await syncSummaryComment(api, 'current', summaryHead, summaryScope), {
+        state: 'updated', commentId: 21, retired: 1,
+    });
+    assert.deepEqual(comments.map((comment) => comment.id), [21, 22]);
+});
+await checkAsync('concurrent first summary runs converge on one marked comment', async () => {
+    let releaseInitialReads = () => undefined;
+    const initialReads = new Promise((resolve) => { releaseInitialReads = resolve; });
+    let reads = 0;
+    let nextId = 20;
+    const comments = [];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => {
+            if (reads < 2) {
+                const snapshot = [...comments];
+                reads++;
+                if (reads === 2)
+                    releaseInitialReads();
+                await initialReads;
+                return snapshot;
+            }
+            return [...comments];
+        },
+        createIssueComment: async (body) => {
+            const created = { id: nextId++, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async () => { throw new Error('must not update'); },
+        deleteIssueComment: async (id) => {
+            const index = comments.findIndex((comment) => comment.id === id);
+            if (index !== -1)
+                comments.splice(index, 1);
+        },
+    };
+    await Promise.all([
+        syncSummaryComment(api, '## PowerShot\n\nCurrent', summaryHead, summaryScope),
+        syncSummaryComment(api, '## PowerShot\n\nCurrent', summaryHead, summaryScope),
+    ]);
+    assert.equal(comments.filter((comment) => comment.body.startsWith(ownedSummaryMarker)).length, 1);
+});
+await checkAsync('different workflows replace a shared legacy summary without cross-scope PATCH', async () => {
+    let releaseInitialReads = () => undefined;
+    const initialReads = new Promise((resolve) => { releaseInitialReads = resolve; });
+    let reads = 0;
+    let nextId = 31;
+    const legacy = { id: 30, body: '## PowerShot\n\nLegacy', user: { login: 'github-actions[bot]' } };
+    const comments = [legacy];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => {
+            if (reads < 2) {
+                const snapshot = [...comments];
+                reads++;
+                if (reads === 2)
+                    releaseInitialReads();
+                await initialReads;
+                return snapshot;
+            }
+            return [...comments];
+        },
+        createIssueComment: async (body) => {
+            const created = { id: nextId++, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async () => { throw new Error('legacy ownership must not use PATCH'); },
+        deleteIssueComment: async (id) => {
+            const index = comments.findIndex((comment) => comment.id === id);
+            if (index !== -1)
+                comments.splice(index, 1);
+        },
+    };
+    const auditScope = 'xcrft/powershot/.github/workflows/audit.yml:audit';
+    await Promise.all([
+        syncSummaryComment(api, 'review', summaryHead, summaryScope),
+        syncSummaryComment(api, 'audit', summaryHead, auditScope),
+    ]);
+    assert.equal(comments.some((comment) => comment.id === legacy.id), false);
+    assert.equal(comments.filter((comment) => comment.body.startsWith(summaryMarker(summaryScope))).length, 1);
+    assert.equal(comments.filter((comment) => comment.body.startsWith(summaryMarker(auditScope))).length, 1);
+});
 check('GitHub patches expose only added right-side lines for inline comments', () => {
     const patch = [
         '@@ -1,3 +1,4 @@',
@@ -842,10 +1226,20 @@ await checkAsync('the GitHub client paginates files, submits the review contract
                 { id: 10, path: 'a.ts', line: 1, body: 'reply', in_reply_to_id: 9, user: { login: 'human' } },
             ]);
         }
+        if (method === 'GET' && url.includes('/issues/7/comments')) {
+            return json([{ id: 21, body: 'summary', user: { login: 'github-actions[bot]' } }]);
+        }
         if (method === 'POST' && url.endsWith('/pulls/7/reviews'))
             return json({ id: 1 });
+        if (method === 'POST' && url.endsWith('/issues/7/comments')) {
+            return json({ id: 22, body: 'new summary', user: { login: 'github-actions[bot]' } }, { status: 201 });
+        }
+        if (method === 'PATCH' && url.endsWith('/issues/comments/21'))
+            return json({ id: 21 });
         if (method === 'DELETE' && url.endsWith('/pulls/comments/9'))
             return json({ message: 'gone' }, { status: 404 });
+        if (method === 'DELETE' && url.endsWith('/issues/comments/21'))
+            return new Response(undefined, { status: 204 });
         return json({ message: 'unexpected request' }, { status: 500 });
     };
     globalThis.fetch = fakeFetch;
@@ -861,11 +1255,19 @@ await checkAsync('the GitHub client paginates files, submits the review contract
         assert.equal(comments[1]?.inReplyToId, 9);
         await api.createReview('a'.repeat(40), [{ path: 'a.ts', line: 1, side: 'RIGHT', body: 'finding' }]);
         await api.deleteReviewComment(9);
+        assert.deepEqual(await api.listIssueComments(), [
+            { id: 21, body: 'summary', user: { login: 'github-actions[bot]' } },
+        ]);
+        await api.updateIssueComment(21, 'updated summary');
+        assert.deepEqual(await api.createIssueComment('new summary'), {
+            id: 22, body: 'new summary', user: { login: 'github-actions[bot]' },
+        });
+        await api.deleteIssueComment(21);
     }
     finally {
         globalThis.fetch = originalFetch;
     }
-    const submitted = calls.find((call) => call.method === 'POST');
+    const submitted = calls.find((call) => call.method === 'POST' && call.url.endsWith('/pulls/7/reviews'));
     assert.ok(submitted?.body);
     assert.deepEqual(JSON.parse(submitted.body), {
         commit_id: 'a'.repeat(40),
@@ -874,6 +1276,9 @@ await checkAsync('the GitHub client paginates files, submits the review contract
         comments: [{ path: 'a.ts', line: 1, side: 'RIGHT', body: 'finding' }],
     });
     assert.equal(calls.filter((call) => call.url.includes('/files')).length, 2);
+    assert.equal(calls.some((call) => call.method === 'PATCH' && call.url.endsWith('/issues/comments/21') && call.body === '{"body":"updated summary"}'), true);
+    assert.equal(calls.some((call) => call.method === 'POST' && call.url.endsWith('/issues/7/comments') && call.body === '{"body":"new summary"}'), true);
+    assert.equal(calls.some((call) => call.method === 'DELETE' && call.url.endsWith('/issues/comments/21')), true);
 });
 await checkAsync('inline synchronization creates one review before removing stale comments', async () => {
     const finding = {
@@ -976,6 +1381,11 @@ check('the public action persists judge answers and publishes only a verdict', (
     assert.match(action, /inline-comments:\s*\n\s+description: [^\n]+\n\s+default: 'false'/);
     assert.match(action, /Post inline comments[\s\S]+inputs\.inline-comments == 'true'[\s\S]+steps\.review\.outputs\.complete == 'true'/);
     assert.match(action, /node "\$GITHUB_ACTION_PATH\/dist\/github\/inline-comments\.js"/);
+    assert.doesNotMatch(action, /--edit-last/);
+    assert.match(action, /node "\$GITHUB_ACTION_PATH\/dist\/github\/summary-comment\.js"/);
+    assert.match(action, /POWERSHOT_HEAD_SHA: \$\{\{ github\.event\.pull_request\.head\.sha \}\}/);
+    assert.match(action, /GITHUB_WORKFLOW_REF: \$\{\{ github\.workflow_ref \}\}/);
+    assert.match(action, /GITHUB_JOB: \$\{\{ github\.job \}\}/);
     assert.match(action, /--report manifest=powershot\.manifest\.json/);
     assert.match(action, /coverage=\$COVERAGE/);
     assert.match(action, /m\.coverage === "full" \|\| m\.coverage === "portable" \? m\.coverage : "unknown"/);
@@ -988,6 +1398,7 @@ check('published CI examples preserve one verdict and its exit status', () => {
     assert.match(action, /upload-sarif: 'true'/);
     assert.match(action, /inline-comments: 'true'/);
     assert.match(action, /runs-on: ubuntu-24\.04/);
+    assert.match(action, /concurrency:[\s\S]+github\.workflow[\s\S]+cancel-in-progress: true/);
     assert.doesNotMatch(action, /npm ci|NPM_AUTH_TOKEN|NODE_AUTH_TOKEN/);
     assert.match(action, /uses: xcrft\/powershot@v1/);
     assert.match(github, /npm install --global --ignore-scripts @0xcraft\/powershot@1\.1\.2/);
@@ -1019,10 +1430,12 @@ check('the viewer labels a complete portable session', () => {
     const html = viewer([], {
         id: 'portable', target: 'workspace', started: '2026-01-01T10:00:00Z',
         state: 'complete', notLookedAt: [], coverage: 'portable',
-        unavailableCoverage: ['1 file(s) without enriched semantic coverage: app.ts (types)'],
+        verifyOnly: true, minSeverity: 'medium', filesReviewed: 1, deterministicChecks: 2,
+        scopeDetails: ['1 reviewed file lacked type information'],
     });
-    assert.match(html, /Portable coverage\./);
-    assert.match(html, /No findings in portable coverage\./);
+    assert.match(html, /1 file reviewed · 2 deterministic checks · portable coverage/);
+    assert.match(html, /No medium-or-higher deterministic findings\./);
+    assert.match(html, /<summary>Coverage details<\/summary>/);
 });
 check('the viewer escapes content rather than rendering it', () => {
     const nasty = [{ ...sample[0], title: '<img src=x onerror=alert(1)>' }];

package/dist/session.js

@@ -105,9 +105,13 @@ export class Session {
             verified: findings.filter((f) => f.class === 'verified').length,
             judged: findings.filter((f) => f.class === 'judged').length,
             state: verdict.state,
-            notLookedAt: verdict.notLookedAt,
+            notLookedAt: [...verdict.notLookedAt],
             coverage: verdict.coverage,
-            unavailableCoverage: verdict.unavailableCoverage,
+            verifyOnly: verdict.verifyOnly,
+            minSeverity: verdict.minSeverity,
+            filesReviewed: verdict.filesReviewed,
+            deterministicChecks: verdict.deterministicChecks,
+            scopeDetails: verdict.scopeDetails ? [...verdict.scopeDetails] : undefined,
         };
         this.save();
     }

package/docs/architecture.md

@@ -66,6 +66,7 @@ engine. The engine does not depend on a workflow provider or terminal layout.
 | `src/judges/` | Prompt data, bounded model loop, tool adapter | Git target selection |
 | `src/lang/` | Language-pack data, isolated parser workers, optional language oracles | Cross-run policy |
 | `src/report/` | Pure output adapters | Re-running or reinterpreting a review |
+| `src/github/` | GitHub REST transport and pull-request publication reconciliation | Review decisions or report rendering |
 | `src/bench.ts` | Historical and labelled evaluation | Production command dispatch |
 | `src/session.ts`, `src/cache.ts` | Reuse of completed judge work | Completion decisions |
 

package/docs/ci.md

@@ -41,6 +41,10 @@ name: PowerShot
 on:
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
   pull-requests: write
@@ -77,6 +81,27 @@ and bounded batches, so all declared languages can coexist in one monorepo revie
 Set `upload-sarif: 'false'` and omit `security-events: write` when GitHub code scanning
 is unavailable or the workflow should not publish SARIF.
 
+`comment: 'true'` maintains one summary through a hidden marker scoped to the caller's
+workflow file and job. Reruns update only that exact `github-actions[bot]` comment, so
+another workflow or job using the same bot identity is left alone. Each candidate also
+records its pull-request head. A new head gets a new candidate, which means an old run
+never patches or retires the current head's comment. The first scoped run replaces the
+newest unmarked legacy `## PowerShot` summary from v1.1.2 or older without claiming the
+ambiguous legacy comment through `PATCH`.
+
+The comment leads with the verdict, effective severity threshold, review mode, and
+aggregate file/check counts. Portable gaps and files outside parser coverage stay
+visible under a collapsed coverage section without filling the timeline with paths.
+The generated `powershot.manifest.json` keeps the per-file accounting for workflows
+that want to persist it as an artifact.
+
+PowerShot checks the target head throughout reconciliation and removes its own
+just-created candidate if it observes a changed head. Simultaneous same-head runs
+relist and converge on one scoped candidate when they complete. Keep the example's
+`concurrency` block to reduce overlap and canceled stale work. GitHub's issue-comment
+REST API has no atomic create-if-absent operation, and cancellation cannot stop a REST
+request already in flight, so concurrency reduces but cannot eliminate that window.
+
 `inline-comments: 'true'` requires `pull-requests: write`. It publishes at most ten
 findings as one review. Only deterministic `verified` findings with `proven`
 confidence, severity `medium` or higher, and a GitHub-confirmed added line qualify.

package/examples/github-actions/action.yml

@@ -3,6 +3,10 @@ name: PowerShot
 on:
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
   pull-requests: write

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@0xcraft/powershot",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "description": "Oracle-first code review for machine-written code, with deterministic verification and CI-ready reports.",
   "license": "Apache-2.0",
   "author": "aglumova <alina.glumova@gmail.com>",