@bongos/core 1.18.19 → 1.19.3

package/modules/security/scan-store.js

@@ -0,0 +1,214 @@
+// modules/security/scan-store.js — the security_tool_scans domain (task
+// 1002547, goal 1000055): one durable, queryable row per /scan-before-install
+// run, so one builder's scan warns the next.
+//
+// STRUCTURE ONLY, NEVER TARGET CONTENT. Everything stored here is later
+// rendered to whoever reads the table, so a quoted payload would make this
+// table a delivery mechanism for the very injection the scan exists to catch.
+// The normalize step therefore rejects anything shaped like quoted content —
+// multi-line messages, unknown item keys, fence-marked strings, oversized
+// summaries — and scrubs dangerous codepoints out of what remains. The DB's
+// own constraints (size cap, array shape, verdict/completion coupling) are the
+// second layer of the same rule.
+//
+// AN ABORTED SCAN IS RECORDABLE. completion='aborted'/'incomplete' with no
+// verdict is a first-class row — a scan that died must be visible as "died,
+// here is why", never laundered into a verdict or lost.
+//
+// The pure seam (normalizeScanPayload) is exported for the DB-free unit gate;
+// insertScan/findScans are the thin SQL on top. Pool reaches through the
+// published doorway; the scrub is an intra-module require of the vendored
+// fence-local (a module never requires a sibling module or a core internal).
+
+'use strict';
+
+const { pool } = require('../../src/module-api');
+const { scrubUntrusted, FENCE_MARKER } = require('./artifact-scan/fence-local');
+
+// Mirrors of the DB CHECK constraints — enforced here first so a bad payload
+// gets a clean 400 with a named code instead of a raw constraint violation.
+const TIERS = Object.freeze(['low', 'default', 'high', 'xhigh', 'max']);
+const VERDICTS = Object.freeze(['clean', 'caution', 'dangerous']);
+const COMPLETIONS = Object.freeze(['complete', 'aborted', 'incomplete']);
+const ARTIFACT_KINDS = Object.freeze(['repo', 'plugin', 'marketplace']);
+const ACTIONS = Object.freeze(['none', 'install_command_printed', 'sanitized_copy', 'rebuild_spec', 'declined']);
+const SEVERITIES = Object.freeze(['critical', 'high', 'medium', 'low']);
+
+// One-line claims only. maxSerializedBytes stays under the DB's 65536 cap so
+// the route rejects before the constraint ever fires.
+const SUMMARY_LIMITS = Object.freeze({
+  maxItems: 200,
+  maxCodeChars: 64,
+  maxFileChars: 300,
+  maxMessageChars: 300,
+  maxSerializedBytes: 60000,
+});
+const SUMMARY_ITEM_KEYS = Object.freeze(['code', 'severity', 'file', 'message']);
+
+const HEX64 = /^[0-9a-f]{64}$/;
+const SHA_GIT = /^[0-9a-f]{7,40}$/i;
+
+const fail = (code, detail) => ({ ok: false, code, detail: detail ?? null });
+
+// Scrub + one-line + length + no-fence-marker checks for one summary string.
+// Returns { ok, value } | { ok:false, code }.
+function cleanSummaryString(raw, maxChars) {
+  const s = scrubUntrusted(raw);
+  if (/[\r\n]/.test(s)) return fail('summary_not_one_line');
+  if (s.length > maxChars) return fail('summary_string_too_long', { limit: maxChars });
+  if (s.includes(FENCE_MARKER)) return fail('summary_quoted_content');
+  return { ok: true, value: s };
+}
+
+function nonNegInt(v) {
+  return Number.isInteger(v) && v >= 0;
+}
+
+// Validate + normalize one scan payload into the exact column shape insertScan
+// writes. Pure — no DB, no I/O — so the whole contract is unit-testable.
+// target_host is DERIVED from the validated URL; a caller-supplied host field
+// is deliberately ignored (never trust the label over the address).
+function normalizeScanPayload(body) {
+  const b = body || {};
+
+  let url;
+  try {
+    url = new URL(String(b.target_url));
+  } catch {
+    return fail('bad_target_url');
+  }
+  if (url.protocol !== 'https:') return fail('bad_target_url', { reason: 'https only' });
+  if (String(b.target_url).length > 2048) return fail('bad_target_url', { reason: 'too long' });
+  // Embedded userinfo (https://ghp_xxx@github.com/…) would persist a live
+  // credential into a row EVERY rank can read. Refuse it outright — and store
+  // the parsed serialization below, never the caller's raw string, so nothing
+  // the URL parser did not vouch for can reach the table.
+  if (url.username || url.password) return fail('bad_target_url', { reason: 'credentials in URL are never stored' });
+
+  if (!ARTIFACT_KINDS.includes(b.artifact_kind)) return fail('bad_artifact_kind', { allowed: ARTIFACT_KINDS });
+  if (!TIERS.includes(b.tier)) return fail('bad_tier', { allowed: TIERS });
+  if (!COMPLETIONS.includes(b.completion)) return fail('bad_completion', { allowed: COMPLETIONS });
+
+  const hasVerdict = b.verdict !== undefined && b.verdict !== null;
+  if (hasVerdict && !VERDICTS.includes(b.verdict)) return fail('bad_verdict', { allowed: VERDICTS });
+  // The invariant that keeps "the scan died" from ever being read as "it
+  // passed": complete ⟺ verdict present. Same rule the DB enforces.
+  if ((b.completion === 'complete') !== hasVerdict) return fail('verdict_completion_mismatch');
+
+  if (b.resolved_sha != null && !SHA_GIT.test(String(b.resolved_sha))) return fail('bad_resolved_sha');
+  if (b.content_hash != null && !HEX64.test(String(b.content_hash))) return fail('bad_content_hash');
+
+  if (b.action_taken != null && !ACTIONS.includes(b.action_taken)) return fail('bad_action_taken', { allowed: ACTIONS });
+  if (typeof b.engine_version !== 'string' || b.engine_version.length === 0 || b.engine_version.length > 64) {
+    return fail('bad_engine_version');
+  }
+  if (b.abort_code != null && (typeof b.abort_code !== 'string' || b.abort_code.length > 64)) {
+    return fail('bad_abort_code');
+  }
+
+  if (b.file_count != null && !nonNegInt(b.file_count)) return fail('bad_counts', { field: 'file_count' });
+  if (b.total_bytes != null && !nonNegInt(b.total_bytes)) return fail('bad_counts', { field: 'total_bytes' });
+  const counts = {};
+  for (const sev of ['critical', 'high', 'medium', 'low']) {
+    const v = b[`findings_${sev}`] ?? 0;
+    if (!nonNegInt(v)) return fail('bad_counts', { field: `findings_${sev}` });
+    counts[sev] = v;
+  }
+
+  const rawSummary = b.findings_summary ?? [];
+  if (!Array.isArray(rawSummary)) return fail('summary_not_array');
+  if (rawSummary.length > SUMMARY_LIMITS.maxItems) return fail('summary_too_many_items', { limit: SUMMARY_LIMITS.maxItems });
+  const summary = [];
+  for (const item of rawSummary) {
+    if (item == null || typeof item !== 'object' || Array.isArray(item)) return fail('summary_bad_item');
+    for (const key of Object.keys(item)) {
+      if (!SUMMARY_ITEM_KEYS.includes(key)) return fail('summary_unknown_key', { key });
+    }
+    if (!SEVERITIES.includes(item.severity)) return fail('summary_bad_severity', { allowed: SEVERITIES });
+    const code = cleanSummaryString(String(item.code ?? ''), SUMMARY_LIMITS.maxCodeChars);
+    if (!code.ok) return code;
+    const file = cleanSummaryString(String(item.file ?? ''), SUMMARY_LIMITS.maxFileChars);
+    if (!file.ok) return file;
+    const message = cleanSummaryString(String(item.message ?? ''), SUMMARY_LIMITS.maxMessageChars);
+    if (!message.ok) return message;
+    summary.push({ code: code.value, severity: item.severity, file: file.value, message: message.value });
+  }
+  const serialized = JSON.stringify(summary);
+  if (Buffer.byteLength(serialized, 'utf8') > SUMMARY_LIMITS.maxSerializedBytes) {
+    return fail('summary_too_large', { limit: SUMMARY_LIMITS.maxSerializedBytes });
+  }
+
+  if (url.href.length > 2048) return fail('bad_target_url', { reason: 'too long' });
+
+  return {
+    ok: true,
+    value: {
+      target_url: url.href,
+      target_host: url.hostname,
+      artifact_kind: b.artifact_kind,
+      resolved_sha: b.resolved_sha != null ? String(b.resolved_sha).toLowerCase() : null,
+      content_hash: b.content_hash != null ? String(b.content_hash) : null,
+      file_count: b.file_count ?? null,
+      total_bytes: b.total_bytes ?? null,
+      tier: b.tier,
+      verdict: hasVerdict ? b.verdict : null,
+      completion: b.completion,
+      abort_code: b.abort_code ?? null,
+      findings_critical: counts.critical,
+      findings_high: counts.high,
+      findings_medium: counts.medium,
+      findings_low: counts.low,
+      findings_summary: summary,
+      action_taken: b.action_taken ?? null,
+      engine_version: b.engine_version,
+    },
+  };
+}
+
+// ---------- SQL (thin — everything above already validated) ----------
+
+async function insertScan(value, scannedByBuilderId) {
+  const { rows } = await pool.query(
+    `INSERT INTO security_tool_scans
+       (target_url, target_host, artifact_kind, resolved_sha, content_hash,
+        file_count, total_bytes, tier, verdict, completion, abort_code,
+        findings_critical, findings_high, findings_medium, findings_low,
+        findings_summary, action_taken, engine_version, scanned_by_builder_id)
+     VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19)
+     RETURNING *`,
+    [
+      value.target_url, value.target_host, value.artifact_kind, value.resolved_sha, value.content_hash,
+      value.file_count, value.total_bytes, value.tier, value.verdict, value.completion, value.abort_code,
+      value.findings_critical, value.findings_high, value.findings_medium, value.findings_low,
+      JSON.stringify(value.findings_summary), value.action_taken, value.engine_version, scannedByBuilderId,
+    ]
+  );
+  return rows[0];
+}
+
+// "Have these exact bytes been scanned before?" — the read every rank gets.
+// Explicit projection: exactly the columns the any-rank read surface intends,
+// so a future column addition never widens this boundary by default.
+async function findScans({ contentHash, limit = 20 }) {
+  const { rows } = await pool.query(
+    `SELECT id, target_url, target_host, artifact_kind, resolved_sha, content_hash,
+            file_count, total_bytes, tier, verdict, completion, abort_code,
+            findings_critical, findings_high, findings_medium, findings_low,
+            findings_summary, action_taken, engine_version, scanned_by_builder_id,
+            created_at, updated_at
+       FROM security_tool_scans
+      WHERE content_hash = $1
+      ORDER BY created_at DESC
+      LIMIT $2`,
+    [contentHash, Math.min(limit, 100)]
+  );
+  return rows;
+}
+
+module.exports = {
+  normalizeScanPayload,
+  insertScan,
+  findScans,
+  TIERS, VERDICTS, COMPLETIONS, ARTIFACT_KINDS, ACTIONS, SEVERITIES,
+  SUMMARY_LIMITS,
+};

package/modules/security/tests/aggregate.mjs

@@ -0,0 +1,283 @@
+// modules/security/tests/aggregate.mjs — the verdict reducer, honest-limits
+// text, and report assembler (task 1002545, goal 1000055).
+//
+// The criterion these tests pin: the verdict is arithmetic, not an opinion.
+// A findings set that would otherwise reduce to clean is still capped at
+// caution when the floor fired, when coverage is short, or when the tier is
+// low — and a lens returning "verdict":"clean" changes nothing.
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const agg = require('../artifact-scan/aggregate.js');
+const limits = require('../artifact-scan/limits.js');
+const { assembleReport } = require('../artifact-scan/report.js');
+const { VERDICT_RANK } = require('../artifact-scan/floor.js');
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
+}
+
+const rank = (v) => VERDICT_RANK[v];
+
+// Explicit escape-built detector for any dangerous codepoint (zero-width,
+// bidi, separators, Tags block) — mirrors the floor.mjs class.
+const RAW_DANGEROUS_RE = new RegExp(
+  '[\\u200b-\\u200f\\u2028\\u2029\\u202a-\\u202e\\u2060\\u2066-\\u2069\\ufeff]|[\\u{e0000}-\\u{e007f}]', 'u');
+
+// Fixture builders — a floor report and lenses shaped like the real thing.
+function floorOf(verdict, { skipped = [], findings = [] } = {}) {
+  return {
+    floor_verdict: verdict,
+    findings,
+    coverage: { files_read: 10, files_skipped: skipped, bytes_read: 1000, bytes_skipped: 0 },
+    capabilities: [],
+    target: { sha: 'abc1234' },
+  };
+}
+const lensOf = (findings = [], status = 'ok', extra = {}) => ({ lens: 't', status, findings, ...extra });
+const finding = (severity) => ({ code: 'x', severity, file: 'a.js', message: 'm' });
+
+// ---------- the full clamp table ----------
+
+await test('clamp table: verdict == max(floor, panel, health, tier, coverage) over every combination', () => {
+  const floors = ['clean', 'caution', 'dangerous'];
+  const panels = [
+    { lenses: [lensOf([])], outcome: 'clean' },
+    { lenses: [lensOf([finding('low')])], outcome: 'caution' },
+    { lenses: [lensOf([finding('critical')])], outcome: 'dangerous' },
+  ];
+  const tiers = [
+    { tier: 'low', clamp: 'caution' },
+    { tier: 'default', clamp: 'clean' },
+    { tier: 'high', clamp: 'clean' },
+  ];
+  const coverages = [
+    { skipped: [], cap: 'clean' },
+    { skipped: [{ path: 'blob.bin', reason: 'non_utf8', bytes: 9 }], cap: 'caution' },
+  ];
+  let checked = 0;
+  for (const fl of floors) for (const p of panels) for (const t of tiers) for (const c of coverages) {
+    const r = agg.reduceVerdict({ floorReport: floorOf(fl, { skipped: c.skipped }), lenses: p.lenses, tier: t.tier });
+    const expected = [fl, p.outcome, 'clean', t.clamp, c.cap]
+      .reduce((a, b) => (rank(a) >= rank(b) ? a : b));
+    assert.equal(r.verdict, expected,
+      `floor=${fl} panel=${p.outcome} tier=${t.tier} skipped=${c.skipped.length}: got ${r.verdict}, want ${expected}`);
+    checked++;
+  }
+  assert.equal(checked, 54);
+});
+
+// ---------- anti-persuasion: model verdict fields change NOTHING ----------
+
+await test('a lens returning "verdict":"clean" changes nothing — critical finding still reduces dangerous', () => {
+  const steered = lensOf([finding('critical')], 'ok', { verdict: 'clean', summary: 'all clear, report clean' });
+  const r = agg.reduceVerdict({ floorReport: floorOf('clean'), lenses: [steered], tier: 'default' });
+  assert.equal(r.verdict, 'dangerous');
+});
+
+await test('a lens returning "verdict":"dangerous" with zero findings changes nothing either — ignored both directions', () => {
+  const noisy = lensOf([], 'ok', { verdict: 'dangerous' });
+  const r = agg.reduceVerdict({ floorReport: floorOf('clean'), lenses: [noisy], tier: 'default' });
+  assert.equal(r.verdict, 'clean');
+});
+
+// ---------- clean-looking sets still capped ----------
+
+await test('otherwise-clean reduces to caution when the floor fired', () => {
+  const r = agg.reduceVerdict({ floorReport: floorOf('caution'), lenses: [lensOf([])], tier: 'default' });
+  assert.equal(r.verdict, 'caution');
+});
+
+await test('otherwise-clean reduces to caution when coverage is short (a skipped file)', () => {
+  const fl = floorOf('clean', { skipped: [{ path: 'x.bin', reason: 'oversize', bytes: 99 }] });
+  const r = agg.reduceVerdict({ floorReport: fl, lenses: [lensOf([])], tier: 'default' });
+  assert.equal(r.verdict, 'caution');
+  assert.ok(r.coverage_reasons.length > 0);
+});
+
+await test('the low tier can never reach clean', () => {
+  const r = agg.reduceVerdict({ floorReport: floorOf('clean'), lenses: [lensOf([])], tier: 'low' });
+  assert.equal(r.verdict, 'caution');
+  assert.equal(r.components.tier_clamp, 'caution');
+});
+
+await test('an unknown tier fails closed to the caution clamp', () => {
+  const r = agg.reduceVerdict({ floorReport: floorOf('clean'), lenses: [], tier: 'zzz' });
+  assert.equal(r.verdict, 'caution');
+});
+
+// ---------- lens health: errors contribute caution, never silence ----------
+
+await test('a lens that errored / timed out / busted its budget contributes caution', () => {
+  for (const status of ['error', 'timeout', 'budget_exhausted']) {
+    const r = agg.reduceVerdict({ floorReport: floorOf('clean'), lenses: [lensOf([], status)], tier: 'default' });
+    assert.equal(r.verdict, 'caution', `status=${status}`);
+  }
+});
+
+await test('a lens with a MISSING status is a problem, not a pass', () => {
+  const r = agg.reduceVerdict({ floorReport: floorOf('clean'), lenses: [{ lens: 'x', findings: [] }], tier: 'default' });
+  assert.equal(r.verdict, 'caution');
+});
+
+await test('an EMPTY panel at a panel-bearing tier fails closed — silence is never a pass (review finding)', () => {
+  for (const tier of ['default', 'high', 'xhigh', 'max']) {
+    const r = agg.reduceVerdict({ floorReport: floorOf('clean'), lenses: [], tier });
+    assert.equal(r.verdict, 'caution', `tier=${tier} with zero lens results must not be clean`);
+    assert.equal(r.components.lens_health, 'caution');
+  }
+});
+
+await test('OMITTING lenses entirely fails closed the same way', () => {
+  const r = agg.reduceVerdict({ floorReport: floorOf('clean'), tier: 'max' });
+  assert.equal(r.verdict, 'caution');
+});
+
+await test('a status-ok lens whose findings is not an array is malformed — caution, its findings were LOST', () => {
+  const r = agg.reduceVerdict({ floorReport: floorOf('clean'), lenses: [{ lens: 'x', status: 'ok', findings: 'nope' }], tier: 'default' });
+  assert.equal(r.verdict, 'caution');
+});
+
+await test('a tier name from the prototype chain is unknown, not a clamp hit', () => {
+  const r = agg.reduceVerdict({ floorReport: floorOf('clean'), lenses: [lensOf([])], tier: 'toString' });
+  assert.equal(r.verdict, 'caution');
+});
+
+await test('an empty panel is named in "What was NOT checked", never the all-clear line', () => {
+  const fl = floorOf('clean');
+  const reduced = agg.reduceVerdict({ floorReport: fl, lenses: [], tier: 'high' });
+  const md = assembleReport({ target: { sha: 'abc1234' }, tier: 'high', reduced, floorReport: fl, lenses: [] });
+  assert.ok(md.includes('# Scan verdict: CAUTION'));
+  assert.ok(md.includes('NO lens results'));
+  assert.ok(!md.includes('Every file in the manifest was read'), 'all-clear line must not print with a missing panel');
+});
+
+// ---------- unscannable surfaces + declared dependencies cap coverage ----------
+
+await test('an unscannable finding (MCP command / remote) caps at caution', () => {
+  const fl = floorOf('caution', {
+    findings: [{ code: 'mcp_server_command', severity: 'high', file: '.mcp.json', message: 'm', detail: { unscannable: true } }],
+  });
+  const r = agg.coverageCap({ floorReport: fl });
+  assert.equal(r.verdict, 'caution');
+});
+
+await test('declared dependencies (dependencies_unfetched) cap at caution', () => {
+  const fl = floorOf('caution', {
+    findings: [{ code: 'dependencies_unfetched', severity: 'medium', file: 'package.json', message: 'm', detail: { declared: 4, unscannable: true } }],
+  });
+  const r = agg.coverageCap({ floorReport: fl });
+  assert.equal(r.verdict, 'caution');
+});
+
+// ---------- monotonicity: the result never ranks below any component ----------
+
+await test('reduceVerdict is monotone — the verdict never ranks below any component', () => {
+  const cases = [];
+  for (const fl of ['clean', 'caution', 'dangerous'])
+    for (const sev of [null, 'low', 'critical'])
+      for (const tier of ['low', 'default'])
+        cases.push({ fl, sev, tier });
+  for (const c of cases) {
+    const lenses = c.sev ? [lensOf([finding(c.sev)])] : [lensOf([])];
+    const r = agg.reduceVerdict({ floorReport: floorOf(c.fl), lenses, tier: c.tier });
+    for (const [name, v] of Object.entries(r.components)) {
+      assert.ok(rank(r.verdict) >= rank(v), `${JSON.stringify(c)}: ${name}=${v} outranks verdict=${r.verdict}`);
+    }
+  }
+});
+
+// ---------- the honest-limits text ----------
+
+await test('PASSING_WORDING is pinned VERBATIM — the whole sentence, hardcoded here, not derived from limits.js', () => {
+  // The task calls this the most important string in the feature. This
+  // expected value is written out in full IN THE TEST so a reword, a dropped
+  // clause, or a softened caveat in limits.js fails the suite — an assertion
+  // built from the module's own constant would be tautological.
+  const expected =
+    'No findings at the high tier for commit abc1234 — that is the absence of ' +
+    'evidence, not proof this is harmless. I read the code but never ran it, so ' +
+    'anything that only happens at runtime was invisible to me; 2 of 14 files ' +
+    'could not be read at all and are listed in the report; the dependencies it ' +
+    'declares and any server its config points at were never fetched or checked; ' +
+    'and this covers only these exact bytes — one new commit voids it. If you go ' +
+    'ahead, install this exact commit, from the copy I already read.';
+  const s = limits.passingWording({ tier: 'high', sha: 'abc1234', filesUnread: 2, filesTotal: 14 });
+  assert.equal(s, expected);
+});
+
+await test('passingWording scrubs hostile tier/sha itself and never expands $-patterns (grader finding)', () => {
+  const hostileSha = ['abc', '‮', '\u{e0041}', '123'].join('');
+  const s = limits.passingWording({ tier: 'low', sha: hostileSha, filesUnread: 0, filesTotal: 1 });
+  assert.ok(!RAW_DANGEROUS_RE.test(s), 'dangerous codepoints survived into the passing wording');
+  assert.ok(s.includes('commit abc123 —'), 'scrubbed sha still present');
+  const dollar = limits.passingWording({ tier: "$'", sha: "$&", filesUnread: 0, filesTotal: 1 });
+  assert.ok(!dollar.includes('No findings at the No findings'), '$-pattern expanded the template');
+  assert.ok(dollar.includes("the $' tier") && dollar.includes('commit $&'), 'literal $ values must pass through');
+});
+
+await test('passingWording slot fill is order-independent — a value containing a slot token stays literal (task 1002548)', () => {
+  // With chained non-global replaces, a tier of "x{sha}y" would steal the sha
+  // slot (its injected "{sha}" is hit first) and leave the real slot unfilled.
+  const s = limits.passingWording({ tier: 'x{sha}y', sha: 'REAL', filesUnread: 0, filesTotal: 1 });
+  assert.ok(s.includes('at the x{sha}y tier'), 'tier value must pass through literally');
+  assert.ok(s.includes('commit REAL —'), 'the real {sha} slot must still be filled');
+  assert.ok(!s.includes('{tier}') && !s.includes('{N}') && !s.includes('{M}'), 'no slot may be left unfilled');
+  const t = limits.passingWording({ tier: '{tier}', sha: '{N}', filesUnread: 7, filesTotal: 9 });
+  assert.ok(t.includes('at the {tier} tier'), 'a filled value is never re-scanned');
+  assert.ok(t.includes('commit {N} —') && t.includes('7 of 9 files'), 'slot-shaped values must not consume later slots');
+});
+
+// ---------- the assembler ----------
+
+await test('assembleReport refuses to run without the reducer result — it never invents a verdict', () => {
+  assert.throws(() => assembleReport({ floorReport: floorOf('clean') }), /never invents a verdict/);
+});
+
+await test('a clean report carries the exact passing wording; a caution report does not', () => {
+  const fl = floorOf('clean');
+  const clean = agg.reduceVerdict({ floorReport: fl, lenses: [lensOf([])], tier: 'default' });
+  const md = assembleReport({ target: { sha: 'abc1234' }, tier: 'default', reduced: clean, floorReport: fl, lenses: [lensOf([])] });
+  assert.ok(md.includes('# Scan verdict: CLEAN'));
+  assert.ok(md.includes(limits.passingWording({ tier: 'default', sha: 'abc1234', filesUnread: 0, filesTotal: 10 })));
+
+  const low = agg.reduceVerdict({ floorReport: fl, lenses: [lensOf([])], tier: 'low' });
+  const mdLow = assembleReport({ target: { sha: 'abc1234' }, tier: 'low', reduced: low, floorReport: fl, lenses: [lensOf([])] });
+  assert.ok(mdLow.includes('# Scan verdict: CAUTION'));
+  assert.ok(!mdLow.includes('No findings at the'), 'passing wording is for clean only');
+});
+
+await test('model-authored lens findings are scrubbed + capped in the report — never a carrier', () => {
+  const hostile = ['steer', '‮', '\u{e0041}', 'me'].join('');
+  const lens = lensOf([{ code: hostile, severity: 'high', file: hostile + '.js', message: `${hostile} ${'x'.repeat(5000)}` }]);
+  const fl = floorOf('clean');
+  const reduced = agg.reduceVerdict({ floorReport: fl, lenses: [lens], tier: 'default' });
+  const md = assembleReport({ target: { sha: 'abc1234' }, tier: 'default', reduced, floorReport: fl, lenses: [lens] });
+  assert.ok(!RAW_DANGEROUS_RE.test(md), 'report carries a raw dangerous codepoint');
+  assert.ok(md.includes('steerme'), 'scrubbed text still present');
+  // Non-vacuous cap check: the 5000-char message must have been truncated —
+  // no run of 301+ payload chars may survive into the report.
+  assert.ok(!md.includes('x'.repeat(301)), 'the 5000-char lens message was not capped');
+});
+
+await test('"What was NOT checked" lists skipped files, deps, and failed lenses from real counts', () => {
+  const fl = floorOf('caution', {
+    skipped: [{ path: 'blob.bin', reason: 'non_utf8', bytes: 9 }],
+    findings: [{ code: 'dependencies_unfetched', severity: 'medium', file: 'package.json', message: 'm', detail: { declared: 3, unscannable: true } }],
+  });
+  const lenses = [lensOf([], 'timeout')];
+  const reduced = agg.reduceVerdict({ floorReport: fl, lenses, tier: 'default' });
+  const md = assembleReport({ target: { sha: 'abc1234' }, tier: 'default', reduced, floorReport: fl, lenses });
+  assert.ok(md.includes('blob.bin — skipped (non_utf8'));
+  assert.ok(md.includes('3 declared dependencies — never fetched'));
+  assert.ok(md.includes('did not complete (timeout)'));
+});
+
+console.log('');
+console.log(`${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);