@applesnort/crosscheck 0.2.0

package/lib/lenses.mjs

@@ -0,0 +1,200 @@
+/*!
+ * Copyright (c) 2026 Joel Mangin. MIT License.
+ */
+// Lens metadata and routing.
+//
+// Routing used to be a prose table a model was asked to interpret. Declaring it
+// in each lens's frontmatter makes the roster decision testable, and lets a bad
+// roster fail before any agent is dispatched rather than after.
+//
+// No YAML dependency: the frontmatter this reads is a deliberately small subset
+// (scalars and inline `[a, b]` lists), and a parser for that subset is smaller
+// than the risk of pulling in a dependency for a five-key header.
+
+const FRONTMATTER = /^---\r?\n([\s\S]*?)\r?\n---/;
+
+// Split a list on commas, but NOT on commas inside {...} or quotes. A glob like
+// `**/*.{js,mjs}` is one pattern; splitting it yields three broken ones, and the
+// lens then matches nothing at all.
+function splitList(body) {
+  const items = [];
+  let current = '';
+  let depth = 0;
+  let quote = null;
+  for (const ch of body) {
+    if (quote) {
+      if (ch === quote) {
+        quote = null;
+      } else {
+        current += ch;
+      }
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (ch === '{' || ch === '[') {
+      depth += 1;
+    } else if (ch === '}' || ch === ']') {
+      depth -= 1;
+    }
+    if (ch === ',' && depth === 0) {
+      items.push(current.trim());
+      current = '';
+      continue;
+    }
+    current += ch;
+  }
+  items.push(current.trim());
+  return items.filter(Boolean);
+}
+
+function parseScalar(raw) {
+  const value = raw.trim();
+  if (value.startsWith('[') && value.endsWith(']')) {
+    return splitList(value.slice(1, -1));
+  }
+  if (value === 'true') {
+    return true;
+  }
+  if (value === 'false') {
+    return false;
+  }
+  return value.replace(/^["']|["']$/g, '');
+}
+
+export function parseFrontmatter(text) {
+  const match = FRONTMATTER.exec(String(text ?? ''));
+  if (!match) {
+    return null;
+  }
+  const meta = {};
+  for (const line of match[1].split(/\r?\n/)) {
+    if (!line.trim() || line.trimStart().startsWith('#')) {
+      continue;
+    }
+    const kv = /^([A-Za-z][\w-]*):(.*)$/.exec(line);
+    if (!kv) {
+      continue;
+    }
+    meta[kv[1]] = parseScalar(kv[2]);
+  }
+  return meta;
+}
+
+export const REQUIRED_KEYS = ['name', 'summary', 'when', 'owns'];
+
+export function validateLens(meta) {
+  const problems = [];
+  if (!meta) {
+    return { ok: false, problems: ['missing frontmatter block'] };
+  }
+  for (const key of REQUIRED_KEYS) {
+    const value = meta[key];
+    const empty = value == null || value === '' ||
+      (Array.isArray(value) && value.length === 0);
+    if (empty) {
+      problems.push(`missing or empty required key: ${key}`);
+    }
+  }
+  if (meta.when && !Array.isArray(meta.when)) {
+    problems.push('`when` must be a list of globs, e.g. [**/*.js]');
+  }
+  // A lens that never declines is a lens that dilutes consensus, so the scope
+  // boundary is required rather than optional.
+  if (meta['not-owns'] == null || meta['not-owns'] === '') {
+    problems.push('missing `not-owns`: every lens must state what it excludes');
+  }
+  return { ok: problems.length === 0, problems };
+}
+
+// Minimal glob matching: `**` across separators, `*` and `?` within a segment.
+// Enough for path routing; deliberately not a full glob implementation.
+export function globToRegExp(glob) {
+  let out = '';
+  const pattern = String(glob ?? '');
+  for (let i = 0; i < pattern.length; i++) {
+    const c = pattern[i];
+    if (c === '*') {
+      if (pattern[i + 1] === '*') {
+        // `**/` may match zero directories, so the separator is optional.
+        if (pattern[i + 2] === '/') {
+          out += '(?:.*/)?';
+          i += 2;
+        } else {
+          out += '.*';
+          i += 1;
+        }
+      } else {
+        out += '[^/]*';
+      }
+      continue;
+    }
+    if (c === '?') {
+      out += '[^/]';
+      continue;
+    }
+    if (c === '{') {
+      const close = pattern.indexOf('}', i);
+      if (close > i) {
+        const alts = pattern.slice(i + 1, close).split(',')
+          .map(a => a.replace(/[.+^${}()|[\]\\]/g, '\\$&'));
+        out += `(?:${alts.join('|')})`;
+        i = close;
+        continue;
+      }
+    }
+    out += c.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+  }
+  return new RegExp(`^${out}$`);
+}
+
+export function matchesAny(file, globs) {
+  return (globs ?? []).some(g => globToRegExp(g).test(file));
+}
+
+// lenses: [{name, when: [globs], ...}], files: [paths in scope]
+// Returns { roster, skipped } — skipped carries a reason per lens, because a
+// silently omitted lens reads as coverage that never happened.
+export function routeRoster(lenses, files) {
+  const roster = [];
+  const skipped = [];
+  for (const lens of lenses ?? []) {
+    const matched = (files ?? []).filter(f => matchesAny(f, lens.when));
+    if (matched.length === 0) {
+      skipped.push({
+        lens: lens.name,
+        reason: `nothing in scope matches ${(lens.when ?? []).join(', ')}`
+      });
+      continue;
+    }
+    roster.push({ ...lens, files: matched });
+  }
+  return { roster, skipped };
+}
+
+// `--only a,b` / `--skip x,y` overrides, applied after routing so an explicit
+// request wins over the glob decision but is still reported.
+export function applyOverrides(routed, { only, skip } = {}) {
+  let { roster, skipped } = routed;
+  if (only?.length) {
+    const keep = new Set(only);
+    skipped = [
+      ...skipped,
+      ...roster.filter(l => !keep.has(l.name))
+        .map(l => ({ lens: l.name, reason: 'excluded by --only' }))
+    ];
+    roster = roster.filter(l => keep.has(l.name));
+  }
+  if (skip?.length) {
+    const drop = new Set(skip);
+    skipped = [
+      ...skipped,
+      ...roster.filter(l => drop.has(l.name))
+        .map(l => ({ lens: l.name, reason: 'excluded by --skip' }))
+    ];
+    roster = roster.filter(l => !drop.has(l.name));
+  }
+  return { roster, skipped };
+}

package/lib/merge.mjs

@@ -0,0 +1,310 @@
+/*!
+ * Copyright (c) 2026 Joel Mangin. MIT License.
+ */
+// Merge per-lens findings into one deduped, ranked set.
+//
+// This is the whole point of the panel: lenses run blind to each other, so two
+// of them landing on the same location is evidence neither one alone provides.
+// The merge normalizes their differing severity vocabularies onto one scale,
+// collapses duplicates, and scores how much independent confirmation a finding
+// actually has.
+//
+// Pure functions only — no IO, no process exit. The CLI in bin/ does that.
+
+export const SEVERITIES = ['CONSIDER', 'FIX', 'BLOCK'];
+
+const TOP_TIER =
+  /^(block|blocker|must[- ]fix|critical|violation|data[- ]corrupting|invisible[- ]failure|high|error)$/i;
+const MIDDLE_TIER =
+  /^(fix|should[- ]fix|warning|warn|medium|moderate)$/i;
+
+export function normalizeSeverity(raw) {
+  const value = String(raw ?? '').replace(/[[\]]/g, '').trim();
+  if (TOP_TIER.test(value)) {
+    return 'BLOCK';
+  }
+  if (MIDDLE_TIER.test(value)) {
+    return 'FIX';
+  }
+  return 'CONSIDER';
+}
+
+export function higherSeverity(a, b) {
+  return SEVERITIES.indexOf(a) >= SEVERITIES.indexOf(b) ? a : b;
+}
+
+// Same place, same issue in substance. Normalizing the text is what lets two
+// lenses phrase one defect differently and still collapse.
+export function normalizeIssue(issue) {
+  return String(issue ?? '')
+    .toLowerCase()
+    .replace(/[`'"]/g, '')
+    .replace(/[^a-z0-9]+/g, ' ')
+    .trim();
+}
+
+// A stable identity for one finding. Used for baselines and SARIF fingerprints,
+// where an exact key is what is wanted. Cross-lens matching does NOT use this —
+// see sameFinding().
+export function findingKey(finding) {
+  return `${finding.file}:${finding.line}|${normalizeIssue(finding.issue)}`;
+}
+
+// Words that carry no signal about which defect is being described. Without
+// this, two findings match on "the" and "a" and everything collapses.
+const STOPWORDS = new Set([
+  'the', 'and', 'for', 'that', 'this', 'with', 'from', 'into', 'not', 'but',
+  'are', 'was', 'were', 'has', 'have', 'had', 'can', 'could', 'would', 'will',
+  'its', 'it', 'is', 'be', 'been', 'so', 'than', 'then', 'when', 'which',
+  'who', 'what', 'how', 'any', 'all', 'each', 'every', 'same', 'other',
+  'instead', 'rather', 'without', 'before', 'after', 'here', 'there', 'they',
+  'them', 'their', 'you', 'your', 'use', 'used', 'using', 'fix', 'should',
+  'must', 'may', 'might', 'does', 'doing', 'done', 'line', 'lines', 'file',
+  'code', 'call', 'calls', 'called', 'caller', 'callers', 'function', 'later',
+  'means', 'make', 'makes', 'still', 'once', 'also', 'both', 'one', 'two'
+]);
+
+export function issueTokens(issue) {
+  return new Set(normalizeIssue(issue).split(' ')
+    .filter(t => t.length >= 3 && !STOPWORDS.has(t)));
+}
+
+// Jaccard similarity over content words, in [0, 1]. Two lenses describing one
+// defect share its nouns — the identifier, the operator, the failure — even when
+// the sentences differ entirely.
+export function issueSimilarity(a, b) {
+  const left = issueTokens(a);
+  const right = issueTokens(b);
+  if (left.size === 0 || right.size === 0) {
+    return 0;
+  }
+  let shared = 0;
+  for (const token of left) {
+    if (right.has(token)) {
+      shared += 1;
+    }
+  }
+  return Number((shared / (left.size + right.size - shared)).toFixed(4));
+}
+
+// Defaults derived from measured lens output, not from hand-written fixtures.
+//
+// Line tolerance: lenses anchor the same defect several lines apart — in one
+// run a swallowed error was cited at 54, 56, and 57 by three lenses — so
+// exact-line matching misses nearly every genuine agreement.
+//
+// Similarity threshold: across two runs, pairs describing the SAME defect
+// scored 0.161 / 0.210 / 0.300 / 0.538, while pairs describing DIFFERENT
+// defects that happened to share a line scored 0.038 / 0.050 (a timing side
+// channel vs a nullish comparison on one expression; an unenforced expiry
+// guard vs a split store contract on another). 0.12 sits in the gap between
+// those bands. The margin is thinner above than below, so under-merging is the
+// failure mode to expect first. Six pairs is a small sample — re-measure when
+// the roster or the lens prompts change.
+export const DEFAULT_LINE_TOLERANCE = 3;
+export const DEFAULT_SIMILARITY_THRESHOLD = 0.12;
+
+export function sameFinding(a, b, options = {}) {
+  const {
+    lineTolerance = DEFAULT_LINE_TOLERANCE,
+    similarityThreshold = DEFAULT_SIMILARITY_THRESHOLD
+  } = options;
+  if (a.file !== b.file) {
+    return false;
+  }
+  if (Math.abs(a.line - b.line) > lineTolerance) {
+    return false;
+  }
+  // Proximity alone is not enough: two unrelated defects can share a line, as
+  // when one lens reports a timing side channel and another a nullish
+  // comparison on the same expression. Those must stay separate.
+  return issueSimilarity(a.issue, b.issue) >= similarityThreshold;
+}
+
+// Independence between two lenses, in [0, 1]. 1 means they never report the
+// same thing, so their agreement is maximally informative; 0 means they are
+// redundant and agreement adds nothing. Derived from calibration data by
+// scripts/calibrate.mjs — see lensOverlap().
+export function independence(a, b, overlap) {
+  if (a === b) {
+    return 0;
+  }
+  const key = [a, b].sort().join('|');
+  const measured = overlap?.[key];
+  // Absent data is treated as fully independent, and the caller is expected to
+  // say so rather than let an unmeasured pair look measured.
+  return measured == null ? 1 : 1 - measured;
+}
+
+// "Effective independent confirmations": 1 for a single lens, and for a set,
+// 1 plus the summed independence of every distinct pair. Two unrelated lenses
+// agreeing scores 2.0; two redundant lenses agreeing scores 1.0. This is what
+// makes consensus mean something beyond counting heads.
+export function consensusScore(lenses, overlap) {
+  const list = [...new Set(lenses ?? [])];
+  if (list.length <= 1) {
+    return 1;
+  }
+  let score = 1;
+  for (let i = 0; i < list.length; i++) {
+    for (let j = i + 1; j < list.length; j++) {
+      score += independence(list[i], list[j], overlap);
+    }
+  }
+  return Number(score.toFixed(4));
+}
+
+// Pairwise overlap measured from a set of per-lens findings: the Jaccard index
+// of the finding keys each pair reported. Feed this back in as `overlap`.
+export function lensOverlap(reports) {
+  const byLens = new Map();
+  for (const report of reports ?? []) {
+    if (!report || report.findings == null) {
+      continue;
+    }
+    byLens.set(report.lens,
+      new Set(report.findings.map(findingKey)));
+  }
+  const lenses = [...byLens.keys()].sort();
+  const overlap = {};
+  for (let i = 0; i < lenses.length; i++) {
+    for (let j = i + 1; j < lenses.length; j++) {
+      const a = byLens.get(lenses[i]);
+      const b = byLens.get(lenses[j]);
+      const union = new Set([...a, ...b]);
+      if (union.size === 0) {
+        continue;
+      }
+      let shared = 0;
+      for (const key of a) {
+        if (b.has(key)) {
+          shared += 1;
+        }
+      }
+      overlap[`${lenses[i]}|${lenses[j]}`] =
+        Number((shared / union.size).toFixed(4));
+    }
+  }
+  return overlap;
+}
+
+// reports: [{lens, findings: [{file, line, severity, issue, fix}], unparsed?}]
+// findings === null means that lens did not complete.
+//
+// options:
+//   overlap  — pairwise overlap map from lensOverlap(), for consensus scoring
+//   escalate — (finding, severity) => severity|null, a policy hook for callers
+//              with non-negotiable categories of their own
+export function mergeFindings(reports, options = {}) {
+  const { overlap, escalate } = options;
+  const clusters = [];
+  const incomplete = [];
+  const unparsed = [];
+
+  for (const report of reports ?? []) {
+    if (!report || report.findings == null) {
+      incomplete.push(report?.lens ?? '<unknown>');
+      continue;
+    }
+    for (const line of report.unparsed ?? []) {
+      unparsed.push({ lens: report.lens, line });
+    }
+    for (const finding of report.findings) {
+      let severity = normalizeSeverity(finding.severity);
+      if (typeof escalate === 'function') {
+        severity = escalate(finding, severity) ?? severity;
+      }
+      // Match against clusters rather than a hash key: independently written
+      // prose never collides exactly, and lenses anchor the same defect a few
+      // lines apart. An exact-key merge reports zero agreement on real output.
+      const existing = clusters.find(c =>
+        c.members.some(m => sameFinding(m, finding, options)));
+      if (existing) {
+        existing.severity = higherSeverity(existing.severity, severity);
+        if (!existing.lenses.includes(report.lens)) {
+          existing.lenses.push(report.lens);
+        }
+        if (!existing.fix && finding.fix) {
+          existing.fix = finding.fix;
+        }
+        // Report the earliest anchor, so the location is stable regardless of
+        // which lens happened to run first.
+        if (finding.line < existing.line) {
+          existing.line = finding.line;
+        }
+        existing.members.push(finding);
+        existing.alsoReported.push({ lens: report.lens, issue: finding.issue });
+        continue;
+      }
+      clusters.push({
+        file: finding.file,
+        line: finding.line,
+        issue: finding.issue,
+        fix: finding.fix ?? null,
+        severity,
+        lenses: [report.lens],
+        members: [finding],
+        alsoReported: []
+      });
+    }
+  }
+
+  const findings = clusters.map(c => {
+    const { members, ...rest } = c;
+    const finding = {
+      ...rest,
+      consensus: c.lenses.length > 1,
+      consensusScore: consensusScore(c.lenses, overlap)
+    };
+    // The key is derived after clustering, from the reported anchor and the
+    // representative issue, so a baseline stays stable across runs.
+    finding.key = findingKey(finding);
+    return finding;
+  });
+
+  // Severity first, then the strength of independent confirmation, then
+  // location so the order is stable across runs.
+  findings.sort((a, b) =>
+    SEVERITIES.indexOf(b.severity) - SEVERITIES.indexOf(a.severity) ||
+    b.consensusScore - a.consensusScore ||
+    a.file.localeCompare(b.file) ||
+    a.line - b.line);
+
+  return { findings, incomplete, unparsed };
+}
+
+// Apply refutation verdicts from a verify pass. verdicts is keyed by finding
+// key: {refuted: boolean, reason?}. Refuted findings are removed from the
+// report and returned separately — a dropped finding that vanishes without a
+// count is indistinguishable from one that was never found.
+export function applyVerdicts(findings, verdicts) {
+  const kept = [];
+  const refuted = [];
+  for (const finding of findings ?? []) {
+    const verdict = verdicts?.[finding.key];
+    if (verdict?.refuted) {
+      refuted.push({ ...finding, refutedReason: verdict.reason ?? null });
+    } else {
+      kept.push(finding);
+    }
+  }
+  return { findings: kept, refuted };
+}
+
+export function countsBySeverity(findings) {
+  const counts = { BLOCK: 0, FIX: 0, CONSIDER: 0 };
+  for (const finding of findings ?? []) {
+    counts[finding.severity] += 1;
+  }
+  return counts;
+}
+
+export function panelVerdict(counts) {
+  if (counts.BLOCK > 0) {
+    return 'Do not ship — blockers present';
+  }
+  if (counts.FIX > 0) {
+    return 'Fix before merge';
+  }
+  return 'Ship';
+}

package/lib/parse.mjs

@@ -0,0 +1,96 @@
+/*!
+ * Copyright (c) 2026 Joel Mangin. MIT License.
+ */
+// Parse a lens's raw text output into structured findings.
+//
+// Lenses emit one finding per line against a fixed contract:
+//   file:line — SEVERITY — issue — fix
+// and return exactly `NO FINDINGS` when nothing in scope is relevant.
+//
+// Parsing is deliberately lenient about the separator (em dash, en dash, or a
+// double hyphen) and strict about everything else: a line that does not carry a
+// location and a severity is not a finding, and is reported as unparsed rather
+// than dropped. Silently discarding a lens's output would turn a broken lens
+// into a clean one.
+
+export const NO_FINDINGS = 'NO FINDINGS';
+
+const SEPARATOR = /\s+(?:—|–|--)\s+/;
+const LOCATION = /^(.+?):(\d+)(?::\d+)?$/;
+
+// A lens that produced nothing usable still has to be distinguishable from a
+// lens that looked and found nothing.
+export function isNoFindings(text) {
+  return String(text ?? '').trim().toUpperCase() === NO_FINDINGS;
+}
+
+function stripBullet(line) {
+  return line.replace(/^\s*(?:[-*+]|\d+[.)])\s+/, '').trim();
+}
+
+export function parseFindingLine(line) {
+  const cleaned = stripBullet(String(line ?? ''));
+  if (!cleaned) {
+    return null;
+  }
+  const parts = cleaned.split(SEPARATOR).map(p => p.trim()).filter(Boolean);
+  if (parts.length < 2) {
+    return null;
+  }
+  const location = LOCATION.exec(parts[0]);
+  if (!location) {
+    return null;
+  }
+  const [, file, line_] = location;
+  const severity = parts[1];
+  // The issue text may itself contain a separator, so the fix is the last
+  // segment and the issue is everything between severity and fix.
+  const fix = parts.length >= 4 ? parts[parts.length - 1] : null;
+  const issueParts = parts.length >= 4
+    ? parts.slice(2, parts.length - 1)
+    : parts.slice(2);
+  const issue = issueParts.join(' — ');
+  if (!issue) {
+    return null;
+  }
+  return { file, line: Number(line_), severity, issue, fix };
+}
+
+// Returns { findings, unparsed, noFindings } for one lens's raw output.
+// `report` of null/undefined means the lens did not complete at all — that is
+// the caller's concern (see mergeFindings), not a parse result.
+export function parseLensOutput(text) {
+  const raw = String(text ?? '');
+  if (isNoFindings(raw)) {
+    return { findings: [], unparsed: [], noFindings: true };
+  }
+  const findings = [];
+  const unparsed = [];
+  for (const line of raw.split('\n')) {
+    if (!line.trim()) {
+      continue;
+    }
+    if (isNoFindings(line)) {
+      continue;
+    }
+    const parsed = parseFindingLine(line);
+    if (parsed) {
+      findings.push(parsed);
+    } else {
+      unparsed.push(line.trim());
+    }
+  }
+  return { findings, unparsed, noFindings: false };
+}
+
+// reports: [{lens, output}] where output is the lens's raw text, or null if the
+// lens did not complete. Produces the shape mergeFindings consumes.
+export function parseReports(reports) {
+  return (reports ?? []).map(r => {
+    if (!r || r.output == null) {
+      return { lens: r?.lens ?? '<unknown>', findings: null, unparsed: [] };
+    }
+    const { findings, unparsed } = parseLensOutput(r.output);
+    return { lens: r.lens, findings, unparsed };
+  });
+}

package/lib/prompt.mjs

@@ -0,0 +1,85 @@
+/*!
+ * Copyright (c) 2026 Joel Mangin. MIT License.
+ */
+// Build the prompt sent to one lens.
+//
+// This is the piece that has to be right for the whole pipeline to work: the
+// output contract in the prompt is what `parse.mjs` expects on the way back. They
+// are two halves of one agreement, so the contract text lives here rather than
+// being retyped by every caller.
+
+export const CONTRACT_LINE =
+  'file:line — SEVERITY — issue — fix';
+
+// A lens that reports on everything is useless, and a lens that quietly reviews
+// outside its remit corrupts the consensus signal — so both halves of its scope
+// are restated in the prompt, not just the part it owns.
+export function buildLensPrompt(lens, files, options = {}) {
+  const {
+    definitionPath = null,
+    definition = null,
+    mixedCorpus = false,
+    extra = null
+  } = options;
+
+  if (!lens?.name) {
+    throw new Error('buildLensPrompt requires a lens with a name');
+  }
+  if (!Array.isArray(files) || files.length === 0) {
+    throw new Error(`no files in scope for lens ${lens.name}`);
+  }
+
+  const parts = [];
+  parts.push(`You are running the **${lens.name}** audit lens.`);
+
+  if (definition) {
+    parts.push(
+      'Adopt this lens completely — its method, its framing, its severity ' +
+      'scale, and its output contract:\n\n' +
+      '--- BEGIN LENS DEFINITION ---\n' + definition.trim() +
+      '\n--- END LENS DEFINITION ---');
+  } else if (definitionPath) {
+    parts.push(
+      `Read \`${definitionPath}\` and adopt it completely — its method, its ` +
+      'framing, its severity scale, and its output contract.');
+  } else {
+    throw new Error(
+      `lens ${lens.name} has neither a definition nor a definitionPath`);
+  }
+
+  if (lens.owns) {
+    parts.push(`You own: ${lens.owns}`);
+  }
+  if (lens['not-owns']) {
+    parts.push(
+      `You do NOT own: ${lens['not-owns']}. Another lens covers those; ` +
+      'reporting them here duplicates that lens and weakens the panel.');
+  }
+
+  parts.push(
+    `Audit exactly these ${files.length} file(s), reading each one completely ` +
+    'before reporting on it:\n' + files.map(f => `  - ${f}`).join('\n'));
+
+  if (mixedCorpus) {
+    parts.push(
+      'Some of these files are safe. Report a file ONLY when you can state the ' +
+      'specific reason it is defective. A wrong finding costs more than a ' +
+      'missed one, so silence is the correct answer wherever you cannot make ' +
+      'the case.');
+  }
+
+  if (extra) {
+    parts.push(extra);
+  }
+
+  parts.push('Do not edit any file. This lens reports.');
+
+  parts.push(
+    'Reply with ONLY finding lines, one per line, in exactly this form:\n\n' +
+    `  ${CONTRACT_LINE}\n\n` +
+    'SEVERITY is BLOCK, FIX, or CONSIDER. Give the path as listed above. No ' +
+    'preamble, no summary, no commentary between findings. If nothing in scope ' +
+    'is relevant to your lens, reply with exactly:\n\n  NO FINDINGS');
+
+  return parts.join('\n\n');
+}