@aarwitz/tapp 0.16.3 → 0.16.5

package/AGENTS.md

@@ -11,7 +11,7 @@ the app already on the simulator); it also accepts a repo dir, a `path/to/App.ap
 bundle id, or (qa only) an http(s) URL. You never need to know a bundle id up front.
 
 ```bash
-npx -y @aarwitz/tapp qa [target]     # autonomous QA → ship/no-ship verdict + findings (≈ tapp_run_qa)
+npx -y @aarwitz/tapp qa [target]     # autonomous QA → scoped release verdict + findings (≈ tapp_run_qa)
 npx -y @aarwitz/tapp open [target]   # launch + screen summary + screenshot saved to a file (≈ tapp_open_app)
 npx -y @aarwitz/tapp tree [target]   # accessibility tree, --json for every element (≈ tapp_ui_tree)
 npx -y @aarwitz/tapp shot            # screenshot the booted sim → file path (≈ tapp_screenshot)
@@ -44,7 +44,7 @@ installs, returns the bundle id) → `tapp_run_qa {appBundleId}`.
 |---|---|---|
 | "Show me / screenshot a screen" | `tapp_open_app` (launch + screenshot + tree, ~15s) | `tapp_run_qa` (a full multi-minute QA exploration) |
 | "Tap through / drive / fill a form / log in" | `tapp_session_start` → `session_act` loop | repeated `open_app` calls (cold relaunch each time) |
-| "Is my app broken? Is it ship-ready? Find bugs" | `tapp_run_qa` — `appBundleId` for iOS, `androidAppId` for Android, `url` for owned web apps | a manual session (QA exploration is autonomous) |
+| "Is my app broken? Is it ship-ready? Find bugs" | `tapp_run_qa` — `appBundleId` for iOS, `androidAppId` for Android, `url` for owned web apps; web `ready` means the disclosed automated checks passed, not that copy/privacy/brand claims were reviewed | a manual session (QA exploration is autonomous) |
 | "Make this flow a repeatable test" | drive it in a session, then `tapp_flow_save`; replay with `tapp_flow_run` | re-driving it by hand every time |
 | "What's on screen right now?" | `tapp_screenshot` / `tapp_ui_tree` | relaunching the app |
 
@@ -82,10 +82,13 @@ Rules that prevent 90% of failures:
 
 ## Autonomous QA (`tapp_run_qa`)
 
-Returns `{verdict, confidence, headline, screensExplored, actionsPerformed, findings[]}`.
+Returns `{verdict, confidence, releaseScore, headline, screensExplored, actionsPerformed, findings[]}`.
+Exploratory web runs set `confidence` and `releaseScore` to `null`; report their deterministic
+finding counts, advisory sampled-probe counts, and coverage instead of inventing a scalar.
 
-- `verdict`: `ready` | `caution` | `blocked`. **Trust it — it's deterministic.** Report it to the
-  user as-is; never soften a `blocked` or inflate a `caution`.
+- `verdict`: `ready` | `caution` | `blocked`. Report it as-is; never soften a `blocked` or inflate a
+  `caution`. Judgment is deterministic for a given evidence trace, while adaptive exploration and
+  live target state can still change which evidence a run observes.
 - `inconclusive: true` means the run couldn't see enough (crash on launch, login wall). That is
   **not a pass** — tell the user what blocked exploration and what would unblock it.
 - Login walls: pass `testEmail`/`testPassword` (auto-typed into login forms), `appLaunchArgs`
@@ -94,6 +97,11 @@ Returns `{verdict, confidence, headline, screensExplored, actionsPerformed, find
   the user** for them rather than re-running blind.
 - Diff two runs: pass the previous run's `findings` as `baselineFindings` → you get a
   `regression` block (`new` / `persisting` / `resolved`, plus a CI `gate` signal).
+- On web, report the exact verdict but preserve its scope: Tapp deterministically checks technical
+  behavior such as failed requests, missing assets, and placeholder links. Dead-control probes are
+  budget-capped advisory findings and do not drive the verdict. Tapp does
+  not validate marketing claims against APIs, API field privacy, brand consistency, or subjective
+  marketplace credibility unless an explicit reviewed test/contract or verifier covers them.
 
 ## Flows (deterministic E2E tests)
 

package/README.md

@@ -26,7 +26,7 @@ Three platforms, one judgment layer:
   does not link a Tapp SDK.
 - **Web (beta)** — built *on* Playwright. Your agent already has browser hands; tapp adds the
   autonomous exploration, the deterministic detectors (uncaught exceptions, failed requests,
-  dead buttons, broken links, error pages), and the same verdict.
+  dead buttons, broken links, placeholder `href="#"` links, error pages), and the same verdict.
 
 ```
 you:    "Add a logout button to the settings screen"
@@ -168,7 +168,7 @@ Then ask your agent:
 | 📸 | `tapp_screenshot` | Whatever's on the sim right now, as an inline image. |
 | 🌳 | `tapp_ui_tree` | The accessibility tree of the current screen (ids, labels, hittability). |
 | 🕹 | `tapp_session_start/act/end` | **Interactive driving** — the Playwright loop. App launches once; each act (tap/type/swipe/back/wait) returns the fresh tree. |
-| 🧪 | `tapp_run_qa` | **Autonomous QA** — explores with no authored test, returns `{verdict, releaseScore, findings[]}`. Takes `appBundleId` (iOS), `androidAppId` (Android), or `url` (web). |
+| 🧪 | `tapp_run_qa` | **Autonomous QA** — explores with no authored test, returns `{verdict, releaseScore, findings[]}` (`releaseScore` is `null` for exploratory web). Takes `appBundleId` (iOS), `androidAppId` (Android), or `url` (web). |
 | 🧭 | `tapp_init` | **Repository import** — detect targets; optionally explore a real surface; persist the shared UI Map; construct the evidence-classified model and grounded release plan. |
 | 👤 | `tapp_actor_config` | **Actor/session setup** — store roles, isolation/provisioning, and environment-variable names without accepting or persisting credential values. |
 | ✅ | `tapp_release_plan` | **Release-plan lifecycle** — inspect, approve/reject/defer, generate, real-target validate, and explicitly promote proposed guarantees without silent test edits. |
@@ -193,7 +193,7 @@ deterministic per-platform navigation root used for bounded changed-surface repl
 
 **Adaptive exploration, deterministic judgment.** Exploration is adaptive — two runs may
 traverse different paths through your app. Judgment is deterministic: the same evidence
-trace always produces the same findings, the same score, and the same verdict — no LLM variability
+trace always produces the same findings and verdict — no LLM variability
 in the decision loop. PR gating keys on the **regression diff**
 (stable finding signatures vs. a baseline), so it reacts to what *changed*, not to
 run-to-run path variance. For critical user journeys, committed **Tasks and Flows** provide the stable CI
@@ -201,22 +201,38 @@ suite: reusable semantic actions, exact assertions, condition-based waits, fresh
 and evidence on failure. We call this *flake-resistant*, not magically flake-free—backend outages,
 unstable test data, and poorly identified controls can still make any E2E test fail.
 
-**A release score, not "confidence."** The 0–100 number is a heuristic quality score from
-fixed, documented deductions — we don't call it confidence because it isn't calibrated
-probability. Calibrating it against seeded-fault benchmarks is ongoing work; until then it
-ranks runs, it doesn't promise odds.
+**Native has a heuristic release score; exploratory web does not.** The native 0–100 number comes
+from fixed deductions and is not calibrated probability. Web reports deterministic findings,
+advisory budget-capped control probes, and concrete coverage instead of compressing those unlike
+signals into a scalar. Committed Flows, Tasks, contracts, and baseline regressions provide the web
+merge decision.
 
 `tapp_run_qa` explores like a user — accessibility surfaces on iOS/Android and a real browser on web —
 and detects crashes, failed sign-ins, dead buttons, stuck loading screens, error surfaces,
 navigation loops, and dead ends (plus, on web: uncaught JS exceptions, failed/5xx requests,
-broken links and assets). The verdict is **deterministic** (no LLM in the run loop) and **honest**:
+broken links and assets, and visible placeholder links with no destination). The verdict is
+**deterministic** (no LLM in the run loop) and **honest**:
 
 - `blocked` — a release-blocking issue was found.
 - `caution` — issues to review, or the run couldn't see enough.
-- `ready` — genuinely explored with no blockers. **A shallow run is never `ready`** — if the
+- `ready` — genuinely explored with no detected blockers in the checks that ran. **A shallow run
+  is never `ready`** — if the
   app crashed on launch or a login wall blocked exploration, you get `inconclusive: true`,
   not a false pass. Absence of findings is not a pass.
 
+Web beta presents a `ready` result as **AUTOMATED CHECKS COMPLETE**, not “ship-ready,” and displays
+no scalar score. Exhaustive checks on each exercised page drive the verdict; sampled control probes
+remain visible findings but are advisory. The report
+explicitly excludes content/claim accuracy, privacy and API data minimization, brand/SEO
+consistency, and subjective visual credibility. Those require reviewed contracts, privacy review,
+or human/vision judgment; an exploratory crawl must not imply they were validated.
+
+For a business guarantee such as “every coach is insured,” use a deterministic app-owned verifier
+endpoint that returns success only when the invariant holds, then require that status and the
+customer-visible claim in a release contract. The current DSL does not yet read arbitrary JSON
+response bodies or compare a cross-origin API payload directly with page copy; use a verifier or an
+explicit CI preflight rather than assuming autonomous QA inferred the guarantee.
+
 Apps behind a login? Pass `testEmail`/`testPassword` (typed into the login form automatically),
 `appLaunchArgs` (e.g. `["--uitesting"]` if your app supports a bypass), or explicit `loginSteps`
 for custom login UIs.

package/mcp-server/src/ci-report.js

@@ -26,7 +26,7 @@
 //   any      fail on any finding at all, or any flow failure. Strictest.
 import fs from "fs";
 import path from "node:path";
-import { buildQaReport, computeRegression, computeContentCollapse, computeReachabilityLoss } from "./report.js";
+import { buildQaReport, computeRegression, computeContentCollapse, computeReachabilityLoss, qaScoreLabel, verdictBadge } from "./report.js";
 import { writeHtmlReport } from "./html-report.js";
 import { buildUiMapFromMarkers, writeUiMap } from "./ui-map.js";
 import { proposeSelectorMaintenance, validateWebMaintenanceProposal } from "./maintenance-proposal.js";
@@ -337,16 +337,18 @@ function enrichPrPlan(plan, contracts, currentUiMap = null, markersPath = "", pr
   return { ...plan, selected, explorationTargets, maintenanceCandidates, execution: counts };
 }
 
-const VERDICT_BADGE = { ready: "🟢 SHIP-READY", caution: "🟡 CAUTION", blocked: "🔴 BLOCKED" };
 const SEV_ICON = { critical: "🟥", high: "🟧", medium: "🟨", low: "🟩" };
 
 function renderMarkdown(report, regression, flows, scenarios, contracts, prPlan, gate) {
   const lines = [];
-  lines.push(`## tapp release check — ${VERDICT_BADGE[report.verdict] || report.verdict}`);
+  lines.push(`## tapp release check — ${verdictBadge(report)}`);
   lines.push("");
   lines.push(report.headline);
   lines.push("");
-  lines.push(`**release score ${report.confidence}/100** · ${report.screensExplored} screens · ${report.actionsPerformed} actions · ${report.findingCounts.total} finding(s)`);
+  lines.push(`**${qaScoreLabel(report)}** · ${report.screensExplored} screens · ${report.actionsPerformed} actions · ${report.findingCounts.total} finding(s)`);
+  if (report.platform === "web") {
+    lines.push(`**Verdict basis:** ${report.verdictFindingCounts?.total || 0} deterministic finding(s); ${report.sampledFindingCounts?.total || 0} sampled probe finding(s) are advisory.`);
+  }
   if (report.uiMap) lines.push(`**UI Map:** ${report.uiMap.nodeCount} states · ${report.uiMap.edgeCount} transitions · ${report.uiMap.controlCount} semantic controls`);
   if (report.findings.length) {
     lines.push("");
@@ -489,11 +491,17 @@ if (collapsed.length) {
   report.findings.push(...collapsed);
   report.findingCounts.high += collapsed.length;
   report.findingCounts.total += collapsed.length;
-  // Keep the displayed verdict consistent with the merged findings (same scoring as report.js:
-  // high costs 10 confidence; any high caps the verdict at caution).
-  report.confidence = Math.max(0, report.confidence - collapsed.length * 10);
-  report.releaseScore = report.confidence;
-  if (report.verdict === "ready") report.verdict = report.confidence < 50 ? "blocked" : "caution";
+  report.verdictFindingCounts.high += collapsed.length;
+  report.verdictFindingCounts.total += collapsed.length;
+  // Keep native scoring compatible. Exploratory web deliberately has no scalar; deterministic
+  // baseline regressions still raise its verdict directly.
+  if (Number.isFinite(report.confidence)) {
+    report.confidence = Math.max(0, report.confidence - collapsed.length * 10);
+    report.releaseScore = report.confidence;
+  }
+  if (report.verdict === "ready") {
+    report.verdict = Number.isFinite(report.confidence) && report.confidence < 50 ? "blocked" : "caution";
+  }
   report.headline = `Proceed with caution — ${collapsed.length} screen(s) regressed vs. baseline (content collapsed or became unreachable).`;
 }
 const regression = computeRegression(report.findings, baseline?.findings ?? null);

package/mcp-server/src/html-report.js

@@ -8,9 +8,8 @@
 
 import fs from "fs";
 import path from "path";
-import { buildQaReport } from "./report.js";
+import { buildQaReport, qaScoreLabel, verdictBadge } from "./report.js";
 
-const BADGE = { ready: "🟢 SHIP-READY", caution: "🟡 CAUTION", blocked: "🔴 BLOCKED" };
 const SEV_COLOR = { critical: "#cf222e", high: "#bc4c00", medium: "#9a6700", low: "#57606a" };
 
 const esc = (s) => String(s ?? "").replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" }[c]));
@@ -102,8 +101,9 @@ export function writeHtmlReport(captureDir, { report, label = "" } = {}) {
 </style>
 </head>
 <body>
-<h1>${BADGE[r.verdict] || esc(r.verdict)} <span class="dim">· release score ${r.releaseScore ?? r.confidence}/100</span></h1>
+<h1>${esc(verdictBadge(r))} <span class="dim">· ${esc(qaScoreLabel(r))}</span></h1>
 <div class="meta">${esc(label)} · ${r.screensExplored} screens · ${r.actionsPerformed} actions · ${r.findingCounts.total} finding(s)</div>
+${r.platform === "web" ? `<div class="meta">Verdict basis: ${r.verdictFindingCounts?.total || 0} deterministic finding(s); ${r.sampledFindingCounts?.total || 0} sampled probe finding(s) are advisory.</div>` : ""}
 <div class="headline">${esc(r.headline)}</div>
 <h2>Findings</h2>
 <ul class="findings">
@@ -114,7 +114,7 @@ ${findingsHtml}
 ${shotsHtml || "<p class='dim'>No screenshots captured.</p>"}
 </div>
 ${videoHtml}
-<footer>Generated by <a href="https://github.com/aarwitz/tapp">Tapp</a> — autonomous QA with a deterministic ship/no-ship verdict. Ship with proof.</footer>
+<footer>Generated by <a href="https://github.com/aarwitz/tapp">Tapp</a> — deterministic automated checks with explicit coverage limits. Review unchecked product risks before release.</footer>
 </body>
 </html>
 `;

package/mcp-server/src/index.js

@@ -12,7 +12,7 @@ import {
   ListToolsRequestSchema,
 } from "@modelcontextprotocol/sdk/types.js";
 
-import { parseOcqaMarkers, buildQaReport, computeRegression } from "./report.js";
+import { parseOcqaMarkers, buildQaReport, computeRegression, qaScoreLabel, verdictBadge } from "./report.js";
 import { existingProjectArtifactPath, projectArtifactDirectory } from "./project-paths.js";
 
 const __filename = fileURLToPath(import.meta.url);
@@ -1289,7 +1289,6 @@ function errorResult(message, details = {}) {
 // programmatic use. This is what makes Tapp feel like a modern dev harness
 // ("Explored 14 screens · 3 issues · ship: caution") rather than a wall of JSON.
 const SEV = { critical: "🔴", high: "🟠", medium: "🟡", low: "⚪️" };
-const VERDICT_BADGE = { ready: "🟢 SHIP-READY", caution: "🟡 CAUTION", blocked: "🔴 BLOCKED" };
 
 /** Result with a human-readable text block first and structured data attached for the agent. */
 function richResult(text, structured) {
@@ -1321,17 +1320,20 @@ export function qaNextSteps(report, surface = "mcp") {
 
 function formatQaReport(report, { regression, inputHint, timedOut, bundleId, aiConfigured, reportHtml, recording, uiMap, surface = "mcp" } = {}) {
   const c = report.findingCounts || {};
-  const badge = VERDICT_BADGE[report.verdict] || report.verdict;
+  const badge = verdictBadge(report);
   const sevBits = ["critical", "high", "medium", "low"]
     .map((k) => (c[k] ? `${SEV[k]} ${c[k]} ${k}` : null))
     .filter(Boolean)
     .join(", ");
   const L = [];
-  L.push(`### 🧪 QA complete — ${badge} · release score ${report.confidence}/100${bundleId ? `\n\`${bundleId}\`` : ""}`);
+  L.push(`### 🧪 QA complete — ${badge} · ${qaScoreLabel(report)}${bundleId ? `\n\`${bundleId}\`` : ""}`);
   L.push("");
   L.push(report.headline);
   L.push("");
   L.push(`**Coverage** — ${report.screensExplored} screens · ${report.actionsPerformed} actions${timedOut ? " · ⏱️ hit time limit" : ""}`);
+  if (report.platform === "web") {
+    L.push(`**Verdict basis** — ${report.verdictFindingCounts?.total || 0} deterministic finding(s); ${report.sampledFindingCounts?.total || 0} sampled probe finding(s) are advisory`);
+  }
   if (uiMap) L.push(`**UI Map** — ${uiMap.nodeCount} states · ${uiMap.edgeCount} transitions · ${uiMap.controlCount} semantic controls · ${uiMap.path}`);
   if (reportHtml) L.push(`**Evidence** — 📄 ${reportHtml} (screenshots of every screen + findings, shareable)`);
   if (recording) L.push(`**Recording** — 🎬 ${recording} (full exploration, embedded in the evidence page)`);
@@ -2071,13 +2073,15 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
       description:
         "Run autonomous QA against iOS (appBundleId), Android (androidAppId), OR a web app " +
         "(url — beta, requires Playwright installed) and return a structured " +
-        "ship/no-ship verdict. Use ONLY when the user wants a QA assessment / to find bugs / a verdict — this " +
+        "QA verdict. Use ONLY when the user wants a QA assessment / to find bugs / a verdict — this " +
         "runs for MINUTES exploring the whole app. Do NOT use it just to view, screenshot, or reach a specific " +
         "screen — use tapp_open_app (launch + screenshot) or a session for that. Tapp explores the app " +
         "like a tester (taps, types, navigates, scrolls) and detects real issues — crashes, dead buttons, failed sign-ins, error screens, " +
         "stuck/hung screens; on web also uncaught JS exceptions, failed/5xx requests, broken links and assets. " +
-        "Returns {verdict: ready|caution|blocked, confidence, headline, screensExplored, " +
-        "actionsPerformed, findings:[{type,severity,category,title,screen}]}. The verdict has a coverage floor: " +
+        "Returns {verdict: ready|caution|blocked, confidence, releaseScore, headline, screensExplored, " +
+        "actionsPerformed, findings:[{type,severity,category,title,screen,evaluationTier}]}. Exploratory web " +
+        "sets confidence/releaseScore to null and separates deterministic verdict findings from advisory " +
+        "sampled control probes. The verdict has a coverage floor: " +
         "if the app barely explored (crash on launch / sign-in wall) it returns 'caution' + inconclusive, never a " +
         "false pass. For iOS the app must already be installed on a booted simulator (use tapp_list_simulators / " +
         "tapp_boot_simulator first). For web, only point it at an app/environment you own — it CLICKS things. " +

package/mcp-server/src/report.js

@@ -86,6 +86,7 @@ export const ISSUE_CATEGORY = {
   submit_failed: "unresponsive_element",
   error_surface: "network_error_surface",
   unresponsive_element: "unresponsive_element",
+  placeholder_link: "broken_link",
   dead_end: "navigation_dead_end",
   navigation_loop: "repeated_loop",
   navigation_trap: "navigation_dead_end",
@@ -95,11 +96,28 @@ export const ISSUE_CATEGORY = {
   explore_timeout: "performance_timeout",
 };
 export const CRITICAL_ISSUE_TYPES = new Set(["crash"]);
+export const WEB_SAMPLED_ISSUE_TYPES = new Set(["unresponsive_element"]);
 
 export function severityRank(s) {
   return { critical: 0, high: 1, medium: 2, low: 3 }[s] ?? 4;
 }
 
+export function findingEvaluationTier(finding, platform = "ios") {
+  return platform === "web" && WEB_SAMPLED_ISSUE_TYPES.has(finding?.type) ? "sampled" : "deterministic";
+}
+
+export function verdictBadge(report) {
+  if (report?.platform === "web" && report?.verdict === "ready") return "🔵 AUTOMATED CHECKS COMPLETE";
+  return { ready: "🟢 SHIP-READY", caution: "🟡 CAUTION", blocked: "🔴 BLOCKED" }[report?.verdict] || report?.verdict;
+}
+
+export function qaScoreLabel(report) {
+  const score = report?.releaseScore ?? report?.confidence;
+  if (Number.isFinite(score)) return `release score ${score}/100`;
+  if (report?.platform === "web") return "exploratory web · no scalar score";
+  return "score unavailable";
+}
+
 // Turn a capture's OCQA markers into the same ship/no-ship report Tapp produces:
 // deduped findings + a trustworthy verdict with a coverage floor (mirrors OrchestratorService).
 export function buildQaReport(markersFilePath, { platform = "ios" } = {}) {
@@ -156,7 +174,9 @@ export function buildQaReport(markersFilePath, { platform = "ios" } = {}) {
   // Chromium can also surface one 404 through both response and requestfailed listeners;
   // keep the concrete missing-asset finding and discard that transport-level duplicate.
   const normalizedIssues = rawIssues.map((issue) => {
-    if (platform !== "web" || !["missing_asset", "network_error"].includes(issue.type)) return issue;
+    if (platform !== "web") return issue;
+    if (issue.type === "placeholder_link" && issue.target) return { ...issue, screen: null };
+    if (!["missing_asset", "network_error"].includes(issue.type)) return issue;
     const title = String(issue.title || "");
     const match = issue.type === "missing_asset"
       ? title.match(/^404 asset:\s+(\S+)/i)
@@ -178,7 +198,11 @@ export function buildQaReport(markersFilePath, { platform = "ios" } = {}) {
     const key = `${i.type}|${i.screen}|${i.target ?? ""}`;
     if (seen.has(key)) continue;
     seen.add(key);
-    findings.push({ ...i, category: ISSUE_CATEGORY[i.type] || i.type });
+    findings.push({
+      ...i,
+      category: ISSUE_CATEGORY[i.type] || i.type,
+      ...(platform === "web" ? { evaluationTier: findingEvaluationTier(i, platform) } : {}),
+    });
   }
   findings.sort((a, b) => severityRank(a.severity) - severityRank(b.severity));
 
@@ -189,23 +213,33 @@ export function buildQaReport(markersFilePath, { platform = "ios" } = {}) {
   const high = findings.filter((f) => f.severity === "high").length;
   const med = findings.filter((f) => f.severity === "medium").length;
   const low = findings.filter((f) => f.severity === "low").length;
+  const verdictFindings = platform === "web"
+    ? findings.filter((finding) => finding.evaluationTier !== "sampled")
+    : findings;
+  const verdictCrit = verdictFindings.filter((f) => f.severity === "critical").length;
+  const verdictHigh = verdictFindings.filter((f) => f.severity === "high").length;
+  const verdictMed = verdictFindings.filter((f) => f.severity === "medium").length;
+  const verdictLow = verdictFindings.filter((f) => f.severity === "low").length;
+  const sampledFindings = platform === "web" ? findings.filter((finding) => finding.evaluationTier === "sampled") : [];
 
   // Coverage floor: a verdict is only trustworthy if the app was actually exercised.
   const inconclusive = screensExplored < 2 || actionsPerformed < 3;
-  let confidence = Math.max(0, Math.min(100, 100 - crit * 25 - high * 10 - med * 3));
-  if (inconclusive) confidence = Math.min(confidence, 40);
+  let riskScore = Math.max(0, Math.min(100, 100 - verdictCrit * 25 - verdictHigh * 10 - verdictMed * 3));
+  if (inconclusive) riskScore = Math.min(riskScore, 40);
 
   let verdict;
-  if (crit > 0) verdict = "blocked";
+  if (verdictCrit > 0) verdict = "blocked";
   else if (inconclusive) verdict = "caution";
-  else if (confidence < 50) verdict = "blocked";
-  else if (high > 0 || confidence < 80) verdict = "caution";
+  else if (riskScore < 50) verdict = "blocked";
+  else if (verdictHigh > 0 || riskScore < 80) verdict = "caution";
   else verdict = "ready";
 
   const headline = inconclusive
     ? `Inconclusive — only ${screensExplored} screen(s) / ${actionsPerformed} action(s) explored. The app may have crashed on launch, be stuck behind a sign-in wall, or otherwise prevent exploration. Absence of issues is NOT a pass.`
     : verdict === "ready"
-    ? "Ship-ready — no release-blocking issues found."
+    ? platform === "web"
+      ? "Automated web checks completed — no release-blocking deterministic findings in the exercised surfaces. Sampled control probes are advisory. This is not a content, privacy, brand, or business-claim review."
+      : "Ship-ready — no release-blocking issues found."
     : verdict === "caution"
     ? `Proceed with caution — ${findings.length} issue(s) to review.`
     : `Not ready — ${findings.length} issue(s): ${crit} critical, ${high} high, ${med} medium, ${low} low.`;
@@ -220,11 +254,14 @@ export function buildQaReport(markersFilePath, { platform = "ios" } = {}) {
   if (platform === "web") {
     checkedFor = [
       "page errors (uncaught exceptions)", "failed/5xx requests", "broken links (404)",
-      "dead buttons", "error text on pages", "load timeouts",
+      "placeholder links with no destination", "sampled dead-button probes (advisory)", "error text on pages", "load timeouts",
     ];
     notChecked = [
       "app-specific business logic (cover with Flows: record or generate, then assert)",
-      "visual correctness — layout/images/clipping (vision review; needs an API key)",
+      "content and claim accuracy (including copy versus API data)",
+      "privacy or API data minimization",
+      "brand and SEO consistency",
+      "visual credibility or asset quality (vision review; needs an API key)",
       "only the first few visible buttons per page are probed (web beta)",
       "content & reachability regressions require a baseline",
     ];
@@ -259,11 +296,14 @@ export function buildQaReport(markersFilePath, { platform = "ios" } = {}) {
 
   return {
     verdict,
-    // `releaseScore` is the honest name: a heuristic quality score from fixed deductions,
-    // NOT calibrated statistical confidence. `confidence` is kept as an alias for
-    // compatibility (baselines, desktop app, existing consumers).
-    confidence,
-    releaseScore: confidence,
+    // Exploratory web QA deliberately has no scalar. Its verdict derives from deterministic
+    // checks on exercised pages; budget-capped control probes remain visible but advisory.
+    // Native keeps the legacy heuristic score until it has an equivalent tier split.
+    confidence: platform === "web" ? null : riskScore,
+    releaseScore: platform === "web" ? null : riskScore,
+    scoreUnavailableReason: platform === "web"
+      ? "Exploratory web runs report deterministic findings, advisory sampled probes, and coverage instead of a scalar release score."
+      : null,
     headline,
     inconclusive,
     checkedFor,
@@ -273,6 +313,20 @@ export function buildQaReport(markersFilePath, { platform = "ios" } = {}) {
     screensExplored,
     actionsPerformed,
     findingCounts: { critical: crit, high, medium: med, low, total: findings.length },
+    verdictFindingCounts: {
+      critical: verdictCrit,
+      high: verdictHigh,
+      medium: verdictMed,
+      low: verdictLow,
+      total: verdictFindings.length,
+    },
+    sampledFindingCounts: {
+      critical: sampledFindings.filter((f) => f.severity === "critical").length,
+      high: sampledFindings.filter((f) => f.severity === "high").length,
+      medium: sampledFindings.filter((f) => f.severity === "medium").length,
+      low: sampledFindings.filter((f) => f.severity === "low").length,
+      total: sampledFindings.length,
+    },
     findings,
     screens: Array.from(screens),
     screenElementCounts,

package/mcp-server/src/web-explorer.js

@@ -40,6 +40,127 @@ export function webControlLabel({ text = "", value = "", ariaLabel = "", title =
     .find(Boolean) || "button";
 }
 
+export function webPlaceholderLinkFindings(links = []) {
+  const findings = [];
+  const seen = new Set();
+  for (const link of links || []) {
+    const rawHref = String(link?.rawHref || "").trim().toLowerCase();
+    const placeholder = rawHref === "#" || /^javascript:(?:void\(0\);?|;?)$/.test(rawHref);
+    if (!placeholder || link?.handlerHint) continue;
+    const label = String(link?.label || "").replace(/\s+/g, " ").trim().slice(0, 100);
+    const fingerprint = String(link?.fingerprint || "link").replace(/\s+/g, " ").trim().slice(0, 100) || "link";
+    const target = label || `unlabeled:${fingerprint}`;
+    if (seen.has(target)) continue;
+    seen.add(target);
+    findings.push({
+      type: "placeholder_link",
+      severity: label ? "medium" : "low",
+      title: label
+        ? `Link "${label}" has no destination (${rawHref === "#" ? 'href="#"' : `href="${rawHref}"`})`
+        : `Unlabeled link has no destination (${rawHref === "#" ? 'href="#"' : `href="${rawHref}"`})`,
+      target,
+    });
+  }
+  return findings;
+}
+
+export function webControlHadEffect({ wired = false, before = {}, after = {} } = {}) {
+  if (wired) return true;
+  return ["url", "title", "heading", "dialogs", "local"]
+    .some((key) => String(before?.[key] ?? "") !== String(after?.[key] ?? ""));
+}
+
+export function shouldReportWebRequestFailure(errorText = "") {
+  // Chromium emits ERR_ABORTED when Tapp deliberately leaves a page while images/video are
+  // still loading. That is navigation lifecycle noise, not evidence that the resource is broken.
+  return !/\bnet::ERR_ABORTED\b/i.test(String(errorText));
+}
+
+export function webPageAppearsBlank({ textLen = 0, controlCount = 0, visualContentCount = 0 } = {}) {
+  return Number(textLen) === 0 && Number(controlCount) === 0 && Number(visualContentCount) === 0;
+}
+
+async function installWebListenerTracking(context) {
+  await context.addInitScript(() => {
+    const key = Symbol.for("tapp.clickListeners");
+    const add = EventTarget.prototype.addEventListener;
+    const remove = EventTarget.prototype.removeEventListener;
+    EventTarget.prototype.addEventListener = function tappTrackedAdd(type, listener, options) {
+      if (type === "click" && this instanceof Element && listener) {
+        if (!this[key]) Object.defineProperty(this, key, { value: new Set(), configurable: true });
+        this[key].add(listener);
+      }
+      return add.call(this, type, listener, options);
+    };
+    EventTarget.prototype.removeEventListener = function tappTrackedRemove(type, listener, options) {
+      if (type === "click" && this instanceof Element && this[key]) this[key].delete(listener);
+      return remove.call(this, type, listener, options);
+    };
+  });
+}
+
+async function captureWebControlState(page, locator) {
+  const global = await page.evaluate(() => {
+    const visible = (element) => {
+      const style = window.getComputedStyle(element);
+      return style.visibility !== "hidden" && style.display !== "none" && element.getClientRects().length > 0;
+    };
+    const dialogs = [...document.querySelectorAll("dialog[open], [role=dialog], [aria-modal=true]")]
+      .filter(visible)
+      .map((element) => (element.getAttribute("aria-label") || element.textContent || "dialog").replace(/\s+/g, " ").trim().slice(0, 160))
+      .sort();
+    return {
+      title: document.title,
+      heading: document.querySelector("h1")?.textContent?.replace(/\s+/g, " ").trim() || "",
+      dialogs: JSON.stringify(dialogs),
+    };
+  }).catch(() => ({ title: "", heading: "", dialogs: "" }));
+
+  const local = await locator.evaluate((element) => {
+    const key = Symbol.for("tapp.clickListeners");
+    const visible = (candidate) => {
+      const style = window.getComputedStyle(candidate);
+      return style.visibility !== "hidden" && style.display !== "none" && candidate.getClientRects().length > 0;
+    };
+    let wired = false;
+    for (let candidate = element; candidate && candidate !== document.body; candidate = candidate.parentElement) {
+      if ((candidate[key] && candidate[key].size > 0) || typeof candidate.onclick === "function" || candidate.hasAttribute("onclick")) {
+        wired = true;
+        break;
+      }
+    }
+    if (!wired && element.matches("button[type=submit], input[type=submit]") && element.closest("form")) wired = true;
+    const describe = (root) => ({
+      tag: root.tagName,
+      className: typeof root.className === "string" ? root.className : "",
+      hidden: root.hidden,
+      open: root.hasAttribute("open"),
+      ariaExpanded: root.getAttribute("aria-expanded"),
+      ariaPressed: root.getAttribute("aria-pressed"),
+      ariaSelected: root.getAttribute("aria-selected"),
+      text: (root.textContent || "").replace(/\s+/g, " ").trim().slice(0, 300),
+      controls: [...root.querySelectorAll("button, a[href], input, textarea, select, [role=button]")]
+        .slice(0, 40)
+        .map((control) => ({
+          tag: control.tagName,
+          visible: visible(control),
+          disabled: !!control.disabled || control.getAttribute("aria-disabled") === "true",
+          checked: "checked" in control ? !!control.checked : null,
+          expanded: control.getAttribute("aria-expanded"),
+          pressed: control.getAttribute("aria-pressed"),
+          selected: control.getAttribute("aria-selected"),
+          label: (control.getAttribute("aria-label") || control.textContent || control.getAttribute("value") || "").replace(/\s+/g, " ").trim().slice(0, 80),
+        })),
+    });
+    const region = element.parentElement || element;
+    const controlledId = element.getAttribute("aria-controls");
+    const controlled = controlledId ? document.getElementById(controlledId) : null;
+    return { wired, signature: JSON.stringify([describe(region), controlled ? describe(controlled) : null]) };
+  }).catch(() => ({ wired: false, signature: "detached" }));
+
+  return { url: page.url(), ...global, local: local.signature, wired: local.wired };
+}
+
 // Wait for a page to stop presenting an explicit loading state and for its semantic
 // surface to remain unchanged across a couple of samples. This is intentionally bounded:
 // live counters and animation-heavy pages still return evidence, marked unsettled.
@@ -314,7 +435,9 @@ export async function exploreWeb({ url, maxActions = 40, timeoutSec = 300, outDi
 
   const { chromium } = await loadPlaywright();
   const browser = await chromium.launch(webBrowserLaunchOptions());
-  const page = await (await browser.newContext({ viewport: { width: 1280, height: 900 } })).newPage();
+  const context = await browser.newContext({ viewport: { width: 1280, height: 900 } });
+  await installWebListenerTracking(context);
+  const page = await context.newPage();
   page.setDefaultTimeout(NAV_TIMEOUT_MS);
 
   const deadline = Date.now() + timeoutSec * 1000;
@@ -324,14 +447,9 @@ export async function exploreWeb({ url, maxActions = 40, timeoutSec = 300, outDi
     emit("ISSUE", { type, severity, title, screen, ...(target ? { target } : {}) });
   };
 
-  // Request counter: cheap "did that click cause network activity" signal for the
-  // dead-button check (a button that fires a request is not dead).
-  let requestCount = 0;
-
   // Async defect listeners: attribute to whatever screen is current when they fire.
   let currentScreen = start.pathname;
   let lastActionTarget = "";
-  page.on("request", () => { requestCount += 1; });
   page.on("pageerror", (err) => issue("js_exception", "high", `Uncaught JS exception: ${String(err.message || err).slice(0, 120)}`, currentScreen));
   page.on("response", (res) => {
     try {
@@ -347,7 +465,9 @@ export async function exploreWeb({ url, maxActions = 40, timeoutSec = 300, outDi
     try {
       const u = new URL(req.url());
       if (u.origin !== start.origin) return;
-      issue("network_error", "medium", `Request failed: ${u.pathname.slice(0, 80)} (${req.failure()?.errorText || "?"})`, currentScreen, u.pathname);
+      const errorText = req.failure()?.errorText || "?";
+      if (!shouldReportWebRequestFailure(errorText)) return;
+      issue("network_error", "medium", `Request failed: ${u.pathname.slice(0, 80)} (${errorText})`, currentScreen, u.pathname);
     } catch {}
   });
 
@@ -363,6 +483,7 @@ export async function exploreWeb({ url, maxActions = 40, timeoutSec = 300, outDi
     ...normalizedSeeds.filter((target) => !targetRoutes.has(target)).map((target) => ({ target, action: `PR target ${target}`, fromScreen: null, prTarget: true })),
   ];
   const screenshotFor = new Map();
+  const placeholderLinksSeen = new Set();
   let actions = 0;
   let screenCount = 0;
   let lastScreen = null;
@@ -413,6 +534,11 @@ export async function exploreWeb({ url, maxActions = 40, timeoutSec = 300, outDi
         title: document.title.trim(),
         controlCount: document.querySelectorAll("a[href], button, [role=button], input, select, textarea").length,
         textLen: (document.body?.innerText || "").trim().length,
+        visualContentCount: [...document.querySelectorAll("img, picture, video, canvas, svg, iframe, object, embed")]
+          .filter((el) => {
+            const style = window.getComputedStyle(el);
+            return style.visibility !== "hidden" && style.display !== "none" && el.getClientRects().length > 0;
+          }).length,
         alertText: [...document.querySelectorAll("[role=alert], [aria-live=assertive]")]
           .map((el) => el.textContent.trim()).filter(Boolean).join(" ").slice(0, 120),
         errorCandidateTexts: [...document.querySelectorAll("h1, h2, h3, p, [data-error], [data-testid*=error i]")]
@@ -428,6 +554,25 @@ export async function exploreWeb({ url, maxActions = 40, timeoutSec = 300, outDi
           .filter((el) => el.offsetParent !== null)
           .map((el) => (el.textContent || "").trim())
           .some((text) => /^(loading|fetching|please wait|preparing|connecting)(?:[.…!]*|\s.*)$/i.test(text)),
+        placeholderLinks: [...document.querySelectorAll("a[href]")]
+          .filter((el) => el.offsetParent !== null)
+          .map((el, index) => {
+            const listenerKey = Symbol.for("tapp.clickListeners");
+            const dataHandler = [...el.attributes]
+              .some((attribute) => /^data-(action|toggle|target|modal|waitlist)(?:-|$)/i.test(attribute.name));
+            const svgPath = el.querySelector("svg path")?.getAttribute("d") || "";
+            return {
+              rawHref: el.getAttribute("href") || "",
+              label: (el.getAttribute("aria-label") || el.getAttribute("title") || el.innerText || el.textContent || "").replace(/\s+/g, " ").trim().slice(0, 100),
+              handlerHint: el.getAttribute("role") === "button"
+                || el.hasAttribute("onclick")
+                || typeof el.onclick === "function"
+                || !!el[listenerKey]?.size
+                || el.hasAttribute("aria-controls")
+                || dataHandler,
+              fingerprint: el.id || el.getAttribute("data-testid") || svgPath.slice(0, 80) || `link-${index + 1}`,
+            };
+          }),
         inputs,
         controls,
       };
@@ -461,11 +606,16 @@ export async function exploreWeb({ url, maxActions = 40, timeoutSec = 300, outDi
       screenCount = screenshotFor.size;
       await page.screenshot({ path: screenshotPath }).catch(() => {});
       // Deterministic per-page detectors run once per distinct screen.
-      if (info.textLen < 10) issue("blank_screen", "high", "Page rendered no visible text", screen);
+      if (webPageAppearsBlank(info)) issue("blank_screen", "high", "Page rendered no visible content", screen);
       else {
         const errorText = webErrorSurfaceText({ alertText: info.alertText, candidateTexts: info.errorCandidateTexts });
         if (errorText) issue("error_surface", "high", `Error shown: ${errorText.slice(0, 80)}`, screen);
       }
+      for (const finding of webPlaceholderLinkFindings(info.placeholderLinks)) {
+        if (placeholderLinksSeen.has(finding.target)) continue;
+        placeholderLinksSeen.add(finding.target);
+        issue(finding.type, finding.severity, finding.title, screen, finding.target);
+      }
     }
     return { key, screen, info };
   }
@@ -626,20 +776,10 @@ export async function exploreWeb({ url, maxActions = 40, timeoutSec = 300, outDi
           id: await b.getAttribute("id").catch(() => ""),
         }).slice(0, 40);
         if (/log ?out|sign ?out|delete|remove/i.test(label)) continue; // don't destroy test state
-        const beforeUrl = page.url();
-        // Dead-button detection watches four real effect channels — DOM mutations, dialogs,
-        // network activity, and navigation — instead of the fragile innerHTML-length proxy
-        // (same length ≠ same page; unrelated tickers ≠ this button worked).
-        await page
-          .evaluate(() => {
-            window.__tappMut = 0;
-            if (window.__tappMo) window.__tappMo.disconnect();
-            window.__tappMo = new MutationObserver((muts) => { window.__tappMut += muts.length; });
-            window.__tappMo.observe(document.body, { childList: true, subtree: true, attributes: true, characterData: true });
-          })
-          .catch(() => {});
-        const dialogsBefore = await page.locator("dialog[open], [role=dialog], [aria-modal=true]").count().catch(() => 0);
-        const reqBefore = requestCount;
+        // Capture only durable, user-visible semantics around this control. A global
+        // MutationObserver is intentionally avoided: carousels, chat launchers, and live
+        // counters can mutate while an unrelated dead button is clicked, creating verdict jitter.
+        const beforeState = await captureWebControlState(page, b);
         actions += 1;
         lastActionTarget = label;
         emit("ACTION", { type: "tap", target: label, screen: webActionScreen(ob), narrative: `Tapped "${label}"` });
@@ -653,16 +793,15 @@ export async function exploreWeb({ url, maxActions = 40, timeoutSec = 300, outDi
           continue;
         }
         await waitForWebStability(page);
-        if (page.url() !== beforeUrl) {
+        if (page.url() !== beforeState.url) {
           await observe();
           await page.goBack({ waitUntil: "domcontentloaded" }).catch(() => {});
           await waitForWebStability(page);
         } else {
-          const mutations = await page.evaluate(() => window.__tappMut || 0).catch(() => 0);
-          const dialogsAfter = await page.locator("dialog[open], [role=dialog], [aria-modal=true]").count().catch(() => 0);
-          const hadEffect = mutations > 0 || dialogsAfter !== dialogsBefore || requestCount > reqBefore;
+          const afterState = await captureWebControlState(page, b);
+          const hadEffect = webControlHadEffect({ wired: beforeState.wired, before: beforeState, after: afterState });
           if (!hadEffect) {
-            issue("unresponsive_element", "medium", `Button "${label}" does nothing`, ob.screen, label);
+            issue("unresponsive_element", "medium", `Button "${label}" has no wiring or observable effect`, ob.screen, label);
           } else {
             // Same-URL SPA transitions are real screens too; URL-only observation
             // under-counted coverage and made healthy applications inconclusive.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aarwitz/tapp",
-  "version": "0.16.3",
+  "version": "0.16.5",
   "mcpName": "io.github.aarwitz/tapp",
   "description": "Release contracts, autonomous QA, and evidence-backed CI gates for iOS, Android, and web.",
   "license": "MIT",