@dailephd/my-dev-kit-lab 0.4.1 → 0.4.2

package/README.md

@@ -1,27 +1,300 @@
 # my-dev-kit-lab
 
-my-dev-kit-lab is the experiment, evidence, reporting, visualization, audit, and security-validation companion for my-dev-kit. It provides controlled retrieval experiments, deterministic demonstrations, reports, plots, galleries, generic audits, and local security-validation workflows.
+> Current release state: v0.4.1 is the latest published baseline. v0.4.0 delivered the Android validation MVP; v0.4.1 delivered advanced Android security. v0.4.2 is implemented and release-prepared (package metadata `0.4.2`) but not yet published. Manual pentest is post-v1 / version TBD.
 
-## Version state
+my-dev-kit-lab is the experiment, evidence, reporting, security-validation, and audit companion for my-dev-kit. It runs reproducible experiments that test whether my-dev-kit's graph-guided retrieval helps coding-agent workflows, collects metrics, renders reports, generates plots, captures screenshots, builds gallery outputs, performs automated CLI/package security validation, and runs the generic audit framework.
 
-`v0.4.1` is the published baseline, with the advanced Android implementation released. `v0.4.0` is the previous published baseline. `v0.4.2` remains future work.
+The generic experiment-plugin framework was introduced in `v0.2.0`. Its first plugin, `context-strategy-comparison`, preserves the raw-full-file vs my-dev-kit-guided comparison through the plugin runner. Later releases added the generic audit framework, language-aware code-rot detectors for TypeScript/JavaScript, Python, Java, and Kotlin, a security-validation audit adapter, and Android validation. See [CHANGELOG.md](CHANGELOG.md) for the complete release history.
 
-## Android validation
+my-dev-kit is most useful when the repository is larger than the task. It helps coding agents work with large codebases through reusable structural indexing, graph-guided retrieval, targeted source slices, and auditable context selection. Results are scoped evidence; the project does not claim that my-dev-kit always saves tokens.
+
+**my-dev-kit** is the repo indexing and graph-guided retrieval engine.
+**my-dev-kit-lab** is the separate lab layer that feeds it benchmark inputs and records evaluation outputs.
+
+---
+
+## Current capabilities
+
+- Benchmark projects at small, medium, and large complexity levels
+- Project complexity metrics and benchmark case metadata with answer keys
+- Prompt variant generation at `short`, `medium`, `long`, and `multi-step` complexity levels
+- Fake-agent adapter for deterministic smoke and demo validation
+- Codex and Claude adapters for real-agent campaigns
+- Controlled experiment runner comparing `raw-full-file` vs `my-dev-kit-guided` strategies
+- Deterministic correctness scoring from answer keys
+- Token usage, duration, and status comparisons between matched strategy pairs
+- HTML experiment report rendering
+- Static SVG plot generation
+- Optional PNG screenshot capture
+- Gallery manifest and static gallery index output
+- Visualization demos using my-dev-kit commands against benchmark projects
+- Final demo workflow combining all pipeline stages
+- Generic experiment-plugin command surface: `experiment:list`, `experiment:describe`, and `experiment:run`
+- First experiment plugin: `context-strategy-comparison`
+- Target-aware experiment execution for local projects via `experiment:run -- --target <path>`
+- Plugin-aware JSON and HTML reports with plugin, target, variant, metric, artifact, warning, skip, and failure metadata
+- Security validation framework: dependency audit, package tarball inspection, CLI adversarial tests, static scans (CodeQL/Semgrep), bounded fuzz smoke, attack-scenario checks, and structured verdict/report output — runnable against any local project via `security:validate --target <path>`. `security:validate` remains the standalone, focused security-validation command; it is not replaced by the audit adapter below.
+- Generic audit framework: `npm run audit` runs conservative code-rot and security detectors and writes text/JSON reports under `reports/audits/` by default. `code-rot` and `security` are the currently implemented audit types (`--types code-rot`, `--types security`, or combined `--types code-rot,security`); `quality`, `project`, and `all` audit types are planned and fail cleanly instead of running. Audit does not modify target files and does not auto-fix issues. See [docs/COMMANDS.md](docs/COMMANDS.md) for full flags.
+- Language-aware code-rot detectors for TypeScript/JavaScript, Python, Java, and Kotlin, built on a shared source-facts model and normalized language/file-role inventory. Java/Kotlin support is conservative static analysis only: no compiler parsing, type/classpath resolution, or Gradle/Maven execution.
+- Security-validation audit adapter: `npm run audit -- --types security` runs the same `security:validate` internals through the shared audit/report surface, mapping findings into audit issues and linking back to the original `reports/security/` report. `security:validate`'s own checks and reports are unaffected.
+- Android validation: `security:validate --profile android` runs nineteen static checks against an Android project (manifest, permissions, exported components, network security config, backup/release configuration, secrets, signing, WebView/FileProvider, sensitive storage/logging, and Firebase/Google services), with optional opt-in Gradle operations and external tools (Semgrep, OSV-Scanner, Android Lint, Dependency-Check). Default execution starts zero Gradle processes, zero external tools, and zero network operations.
+- Android-aware generic audit: `npm run audit -- --types security --android` runs the same static Android validation through the audit adapter, mapping confirmed findings into audit issues while keeping review-only `CandidateEvidence` separate and never treated as a confirmed issue.
+
+---
+
+## Architecture overview
+
+```mermaid
+flowchart TD
+  A[scripts/experiments] --> B[Experiment plugin registry + runner]
+  B --> C[context-strategy-comparison]
+  C --> D[Controlled experiment foundations]
+  D --> E[Plugin + legacy artifacts]
+  E --> F[Plugin-aware reports]
+  E --> G[Plots / screenshots / gallery]
+  H[scripts/security] --> I[Automated security validation]
+  I --> J[Security reports + verdict]
+  I --> K[Android validation]
+  L[scripts/audits] --> M[Generic audit framework]
+  M --> N[Code-rot detectors]
+  M --> I
+```
+
+---
+
+## Quickstart
+
+### Install
+
+```bash
+npm install
+```
+
+The same command works in PowerShell and `cmd.exe`.
+
+### Build
+
+```bash
+npm run build
+```
+
+### Verify the installation
+
+```bash
+npm run verify
+```
+
+### Run the fake-agent final demo (deterministic, no external CLIs required)
+
+```bash
+npm run run-final-demo -- \
+  --cases examples/token-savings-cases.json \
+  --out lab-output/final-demo \
+  --kit-command "node tests/fixtures/fake-my-dev-kit-cli.js" \
+  --agents fake-agent \
+  --complexities short \
+  --no-screenshot
+```
 
 ```powershell
-npm run security:validate -- --target "<android-project-path>" --profile android
+npm run run-final-demo -- `
+  --cases examples/token-savings-cases.json `
+  --out lab-output/final-demo `
+  --kit-command "node tests/fixtures/fake-my-dev-kit-cli.js" `
+  --agents fake-agent `
+  --complexities short `
+  --no-screenshot
+```
+
+```bat
+npm run run-final-demo -- --cases examples/token-savings-cases.json --out lab-output/final-demo --kit-command "node tests/fixtures/fake-my-dev-kit-cli.js" --agents fake-agent --complexities short --no-screenshot
+```
+
+The lab resolves Windows `.cmd` and `.ps1` CLI shims, supports command paths with spaces, and keeps generated artifacts inside the requested output directory.
+
+This runs a full pipeline: controlled experiment → report → plots → visualization demos → gallery.
+
+### Run a real-agent campaign (requires Codex or Claude CLI)
+
+```bash
+npm run run-controlled-experiment -- \
+  --cases examples/real-agent-campaign-cases.json \
+  --agents codex,claude \
+  --strategies raw-full-file,my-dev-kit-guided \
+  --complexities medium,multi-step \
+  --out lab-output/real-agent-campaign \
+  --include-real-agents \
+  --continue-on-failure \
+  --timeout-ms 240000
 ```
 
-The default Android profile runs nineteen checks: the original eight checks plus eleven advanced internal checks for Network Security Config, backup/data extraction, release configuration, secret candidates, signing configuration, WebView, FileProvider, sensitive storage, sensitive logging, clipboard, and Firebase/Google services. It runs zero Gradle operations, zero external tools, and zero network operations by default.
+Real-agent runs require local Codex or Claude CLI setup and available usage capacity. Runs that time out, produce invalid output, or hit session limits are recorded as structured outcomes rather than failures.
+
+### List, describe, and run experiment plugins
+
+```bash
+npm run experiment:list
+npm run experiment:describe -- --experiment context-strategy-comparison
+npm run experiment:run -- \
+  --experiment context-strategy-comparison \
+  --target /path/to/local/project \
+  --agents fake-agent \
+  --complexities short \
+  --no-screenshot
+```
+
+```powershell
+npm run experiment:list
+npm run experiment:describe -- --experiment context-strategy-comparison
+npm run experiment:run -- `
+  --experiment context-strategy-comparison `
+  --target "Z:\Users\newuser\Projects\my-dev-kit-v1" `
+  --agents fake-agent `
+  --complexities short `
+  --no-screenshot
+```
+
+When `--target` is omitted, the experiment runs in self mode against my-dev-kit-lab. When `--target <path>` is provided, the lab remains the tool root and the target project is inspected separately. Generated experiment outputs stay under lab-controlled output directories by default, not inside the target project.
+
+---
+
+## Where to find outputs
+
+| Artifact | Location |
+|---|---|
+| Experiment summary | `lab-output/<experiment>/experiment-summary.json` |
+| All runs | `lab-output/<experiment>/experiment-runs.json` |
+| Strategy comparisons | `lab-output/<experiment>/experiment-comparisons.json` |
+| HTML report | `lab-output/<report>/experiment-report.html` |
+| Report JSON | `lab-output/<report>/experiment-report.json` |
+| Report screenshot | `lab-output/<report>/experiment-report.png` |
+| Plugin experiment report JSON | `lab-output/experiments/<plugin>/<target>/<run>/report.json` |
+| Plugin experiment report HTML | `lab-output/experiments/<plugin>/<target>/<run>/report.html` |
+| Plot data | `lab-output/<plots>/plot-data.json` |
+| SVG charts | `lab-output/<plots>/charts/*.svg` |
+| Gallery manifest | `lab-output/<gallery>/gallery-manifest.json` |
+| Gallery index | `lab-output/<gallery>/gallery-index.html` |
+
+---
+
+## How to read the main report
+
+Open `experiment-report.html` in a browser. The report shows:
+
+- **Project profile** — benchmark project name, language mix, complexity score, and file tree
+- **Benchmark tasks** — task descriptions and answer keys
+- **Strategy comparisons** — paired `raw-full-file` vs `my-dev-kit-guided` runs per case
+- **Correctness scores** — deterministic answer-key scoring (not semantic LLM judging)
+- **Token usage** — estimated or reported token totals per run
+- **Token savings** — positive means my-dev-kit used fewer tokens; negative means it used more
+- **Duration** — wall-clock time per run
+- **Status** — completed, timeout, invalid-output, or limit-reached
+- **Warnings and limitations** — notes on missing token totals or partial results
+
+See [docs/METRICS.md](docs/METRICS.md) for full metric definitions.
+
+---
+
+## Current limitations
+
+- Token savings shown in fake-agent runs are based on estimated character counts, not provider billing telemetry
+- Claude does not expose token totals; token savings comparisons are unavailable for Claude runs
+- Codex may expose token totals but can produce timeouts or invalid-output runs
+- Small projects may make raw-full-file cheaper than my-dev-kit-guided; larger localized tasks are where my-dev-kit is expected to become more useful
+- The generic experiment-plugin framework currently ships one plugin, `context-strategy-comparison`; future plugins such as warm-index reuse, incremental-change, and context-window scaling are not implemented yet
+- The current baseline does not prove token savings are guaranteed; it produces auditable evidence for specific cases, targets, agents, and strategies
+- Provider telemetry dashboards, semantic LLM judging, and cloud API billing integration are not yet implemented
+
+---
+
+## Roadmap direction
+
+my-dev-kit-lab is at a working baseline. The raw-vs-indexed experiment pipeline is fully implemented and produces reproducible artifacts, and real-agent campaign support exists for Codex and Claude. Recent releases added language-aware code-rot detectors (TypeScript/JavaScript, Python, Java, Kotlin), a security-validation audit adapter, and Android validation with an Android-aware extension of that same adapter.
+
+- `v0.4.0` and `v0.4.1`: Android automated security validation (published)
+- `v0.4.2`: Android-aware extension of the existing security audit adapter (see [CHANGELOG.md](CHANGELOG.md) for release status)
+- manual pentest: post-v1 / version TBD
+
+See [docs/ROADMAP.md](docs/ROADMAP.md) for the complete, versioned plan.
+
+---
+
+## Security validation
+
+my-dev-kit-lab owns a release-security validation track for **my-dev-kit**. This work is separate from the experiment pipeline and does not replace the generic experiment-plugin roadmap. Its purpose is to generate release-validation evidence for the local CLI/package before release preparation.
+
+`security:validate` remains the standalone, focused command for this validation and is unaffected by the current checked-out state. `npm run audit -- --types security` additionally adapts the same `security:validate` internals into the shared audit/report surface (mapped issues, a `securitySummary` field, and links to the original `reports/security/` output) — it does not replace or duplicate `security:validate`'s own checks or reports.
+
+This is not a web application pentest framework. **my-dev-kit** is a local CLI/package, so the validation model is CLI/package adversarial testing focused on whether it remains:
+
+- local-first
+- deterministic
+- read-only with respect to user source files
+- network-free during normal CLI operation
+- LLM-free
+- database-free
+- safe to run on local repositories
+
+The automated validation gate is implemented. It combines static scans, dependency/package checks, adversarial CLI tests, bounded fuzz smoke tests, and attack-scenario checks with structured text/JSON reports and a four-category verdict.
+
+### Security commands
+
+| Command | Description |
+|---|---|
+| `npm run security:deps` | npm audit, OSV-Scanner (if available), outdated packages |
+| `npm run security:package` | npm pack --dry-run, forbidden content detection |
+| `npm run security:codeql` | CodeQL CLI availability check; skipped gracefully when absent |
+| `npm run security:semgrep` | Semgrep scan via local binary or npx; skipped gracefully when both absent |
+| `npm run test:security` | Automated security and adversarial CLI tests (path traversal, read-only boundaries, malformed artifacts, JSON safety, and related checks) |
+| `npm run test:fuzz:smoke` | 9 bounded fuzz targets, seeded PRNG, completes in under 1 second |
+| `npm run security:validate` | Runs selected security checks, applies profile-aware defaults when requested, and writes text/JSON reports according to `--format` |
+
+CodeQL, Semgrep, and OSV-Scanner are optional. When unavailable locally, they are recorded as `skipped` in the report, not as passed. That can lead to `ready except optional manual checks`; it does not silently turn missing tooling into a clean pass.
+
+Each security command can validate my-dev-kit-lab itself or another local project via `--target <path>`. When `--target` is omitted, the framework performs self-validation. Target projects are inspected in place: their source files are not modified by default, generated artifacts stay under `reports/security/` unless `--out` is used, and external-target reports identify the tool root, target root, target package metadata, target git metadata, command cwd, exit code, and stdout/stderr summaries.
+
+`security:validate` supports `--checks`, `--profile`, `--format`, `--fail-on`, `--out`, and `--report-prefix`. The no-flag path remains backward compatible and still runs the classic implemented check groups: `deps`, `package`, `static`, `cli-adversarial`, and `fuzz`. Supplying `--profile` without `--checks` swaps in that profile's default checks; supplying explicit `--checks` always wins over profile defaults.
+
+The current attack-scenario checks cover boundary, subprocess, secrets, and network assumptions. They are automated adversarial checks, not a manual pentest. Manual pentest is deferred until after `v1.0.0`. `verdictImpact` metadata from each registered scenario drives blocker categorization in report reasoning, and narrowed `--checks` runs are labeled as scoped rather than described as a full release gate.
+
+JSON report poisoning/config-injection checks use a baseline-diff schema guard so legitimate additive JSON fields do not fail the guard while payload-created trusted top-level fields still do. Text reports are sanitized to strip ANSI/control-byte payloads before rendering.
+
+Known limits remain intentionally explicit: secret scanning is bounded rather than exhaustive, the network/local-first check is a bounded static assumption check rather than proof of runtime isolation, package-boundary severity is still result-level rather than per-evidence-item, and profile-specific scenario behavior is limited to profile-based scenario selection/default checks.
+
+For external-target validation, `security:validate` reads the target `package.json`, detects `scripts.test:security`, and runs `npm run test:security` in the target project root when that script exists. This behavior is validated both from the source checkout and from an installed packed tarball because published-package execution differs from local source execution.
+
+Generated security reports under `reports/security/` are excluded from git by default. They are produced locally or in CI as release-gate evidence and are not committed to the repository.
+
+See [docs/COMMANDS.md](docs/COMMANDS.md) for full command options and [docs/security-validation-framework.md](docs/security-validation-framework.md) for the security model, implemented modules, and release verdicts.
+
+---
+
+## License
+
+MIT License. See [LICENSE](LICENSE) for the full text.
+
+---
+
+## Support
+
+my-dev-kit-lab is an independent project by dailephd LLC, developed and maintained by Dai Le.
 
-`SecurityFinding` records confirmed conservative evidence. `CandidateEvidence` remains separate review or unresolved evidence and is not a confirmed vulnerability. Text and JSON reports under `reports/security/` include advanced-security checks, external-tool results, candidate-evidence summaries, artifacts, mutation evidence, verdict reasons, and limitations.
+If this project helps your workflow, you can support continued development through GitHub Sponsors or PayPal:
 
-Optional Gradle operations use `--android-gradle-operations` and only accept `wrapper-version`, `tasks`, `assemble-debug`, `unit-test-debug`, and `lint-debug`. They are environment-dependent, record mutations, and never perform cleanup or arbitrary tasks.
+- [Sponsor on GitHub](https://github.com/sponsors/dailephd)
+- [Support via PayPal](https://paypal.me/daile88)
 
-Optional external tools use `--android-external-tools semgrep,osv,android-lint,dependency-check`. Network defaults to `--android-external-network deny`; `allow-requested` authorizes only requested supported network-capable tools. Semgrep uses package-owned local rules, Android Lint reuses the closed offline Gradle path, Dependency-Check disables updates, and OSV requires explicit network authorization. Tools are never installed automatically; unavailable requested tools are skipped or inconclusive, not clean passes.
+Support is optional and does not affect access to the project.
 
-Verdicts are `not-ready-security-blocker-remains`, `inconclusive-audit-environment-incomplete`, `ready-except-optional-manual-checks`, and `ready-for-release-preparation`. They are evidence states, not runtime, Play, publication, or pentest guarantees.
+---
 
-Selected local references such as supported `@xml` resources are resolved conservatively. Manifests are not merged, full overlay precedence and Gradle evaluation are not implemented, whole-program flow is not performed, and APK/AAB, signing, emulator/device, remote Firebase, live Play policy, and manual pentest validation remain outside scope.
+## Documentation
 
-See [Project overview](docs/PROJECT_OVERVIEW.md), [Commands](docs/COMMANDS.md), [Workflows](docs/WORKFLOWS.md), [Architecture](docs/ARCHITECTURE.md), and [Roadmap](docs/ROADMAP.md).
+- [docs/PROJECT_OVERVIEW.md](docs/PROJECT_OVERVIEW.md) — product purpose and target users
+- [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) — current and future architecture
+- [docs/WORKFLOWS.md](docs/WORKFLOWS.md) — step-by-step workflows with diagrams
+- [docs/COMMANDS.md](docs/COMMANDS.md) — all commands with options and examples
+- [docs/TUTORIAL.md](docs/TUTORIAL.md) — first-run walkthrough
+- [docs/METRICS.md](docs/METRICS.md) — metric definitions and interpretation
+- [docs/ROADMAP.md](docs/ROADMAP.md) — current baseline and future phases
+- [docs/GALLERY.md](docs/GALLERY.md) — gallery output explained

package/dist/scripts/audits/runAudit.js

@@ -20,9 +20,29 @@ import { writeAuditReports } from "../../src/audits/report/writeAuditReports.js"
 // ---------------------------------------------------------------------------
 const USAGE = "Usage: npm run audit -- [--target <path>] [--types code-rot,security] " +
     "[--include docs,tests,package,architecture,cli] [--format text,json] " +
-    "[--fail-on blocker|high|medium|low|none] [--out <path>]";
+    "[--fail-on blocker|high|medium|low|none] [--out <path>] [--android]\n" +
+    "\n" +
+    "  --android opts into Batch 2's programmatic Android security integration.\n" +
+    "  Requires --types to include \"security\" (e.g. --types security or --types\n" +
+    "  code-rot,security). Runs the same static, read-only, nineteen-check\n" +
+    "  Android validation security:validate --profile android performs --\n" +
+    "  detection, manifest parsing, and internal advanced security checks --\n" +
+    "  through the existing security adapter, never a subprocess. Confirmed\n" +
+    "  findings are mapped into the normal issue collection; CandidateEvidence\n" +
+    "  remains a separate, bounded summary and is never treated as a confirmed\n" +
+    "  issue. Starts zero Gradle operations, zero external tools, and zero\n" +
+    "  network operations by default; --android does not expose any of those.\n" +
+    "  Example: npm run audit -- --target \"<android-project-path>\" --types security --android --format text,json --fail-on none";
 const rawArgs = process.argv.slice(2);
 const toolRoot = resolveToolRoot(import.meta.url);
+// Help deliberately wins over every other argument, mirroring
+// scripts/security/validate.ts -- no config normalization, target
+// resolution, audit execution, or report write.
+if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
+    console.log(USAGE);
+    process.exitCode = 0;
+    process.exit(0);
+}
 let config;
 try {
     const args = parseAuditArgs(rawArgs);
@@ -89,6 +109,13 @@ if (model.securitySummary.ran) {
         console.log(`  Full report: ${model.securitySummary.reportPaths.text}`);
     }
 }
+if (model.androidSecurity.summary.requested) {
+    const android = model.androidSecurity.summary;
+    console.log(`\nAndroid security validation: status=${android.status} applicable=${android.applicable ?? "n/a"} verdict=${android.verdict ?? "(unknown)"} checks=${android.totalChecks} confirmed=${android.confirmedFindingCount} mappedIssues=${android.mappedIssueCount} candidates=${android.candidateSummary.totalCount}`);
+    if (android.reportPaths.text) {
+        console.log(`  Full report: ${android.reportPaths.text}`);
+    }
+}
 console.log(`\nInventory: ${model.inventory.totalScannedFileCount} file(s) scanned, ${model.inventory.skippedFileCount} skipped`);
 console.log(`  source=${model.inventory.filesByCategory.source} tests=${model.inventory.filesByCategory.tests} docs=${model.inventory.filesByCategory.docs} package=${model.inventory.filesByCategory.package} config=${model.inventory.filesByCategory.config} scripts=${model.inventory.filesByCategory.scripts} ci=${model.inventory.filesByCategory.ci}`);
 console.log(`Source of truth: package=${model.sourceOfTruth.packageName ?? "(none)"}@${model.sourceOfTruth.packageVersion ?? "?"} readme=${model.sourceOfTruth.hasReadme} changelog=${model.sourceOfTruth.hasChangelog} ciWorkflows=${model.sourceOfTruth.ciWorkflowCount}`);

package/dist/src/audits/core/auditConfig.js

@@ -8,10 +8,19 @@ const FLAGS_WITH_VALUE = {
     "--fail-on": "failOn",
     "--out": "out",
 };
+// v0.4.2 Batch 3 -- presence-only flags (no following value consumed).
+const BOOLEAN_FLAGS = {
+    "--android": "android",
+};
 export function parseAuditArgs(argv) {
     const result = {};
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
+        const booleanKey = BOOLEAN_FLAGS[arg];
+        if (booleanKey) {
+            result[booleanKey] = true;
+            continue;
+        }
         const key = FLAGS_WITH_VALUE[arg];
         if (!key)
             continue;
@@ -28,6 +37,10 @@ export function normalizeAuditConfig(raw, toolRoot) {
     const formats = parseFormatOption(raw.format);
     const failOn = parseFailOnOption(raw.failOn);
     const out = raw.out !== undefined ? resolveOutDir(raw.out) : defaultOutDir(toolRoot, types.value);
+    const android = raw.android === true;
+    if (android && !types.value.includes("security")) {
+        throw new Error(`Invalid combination: --android requires --types to include "security" (e.g. --types security or --types code-rot,security).`);
+    }
     return {
         targetPathArg: raw.target,
         targetMode: raw.target === undefined ? "self" : "external",
@@ -46,7 +59,9 @@ export function normalizeAuditConfig(raw, toolRoot) {
             raw.include === undefined &&
             raw.format === undefined &&
             raw.failOn === undefined &&
-            raw.out === undefined,
+            raw.out === undefined &&
+            raw.android === undefined,
+        android,
     };
 }
 function splitAndNormalizeList(raw, flagName) {

package/dist/src/audits/core/auditRunner.js

@@ -6,7 +6,7 @@ import { collectSourceOfTruth } from "./sourceOfTruth.js";
 import { collectSourceFacts } from "./collectSourceFacts.js";
 import { collectPythonProjectMetadata } from "./pythonProjectMetadata.js";
 import { runSecurityAuditAdapter } from "../security/securityAuditAdapter.js";
-import { SECURITY_AUDIT_NOT_RUN_SUMMARY } from "../security/securityAuditTypes.js";
+import { ANDROID_AUDIT_NOT_REQUESTED_SUMMARY, SECURITY_AUDIT_NOT_RUN_SUMMARY, } from "../security/securityAuditTypes.js";
 export async function runAudit(options) {
     const { config, toolRoot } = options;
     const registry = options.registry ?? DEFAULT_AUDIT_REGISTRY;
@@ -49,10 +49,12 @@ export async function runAudit(options) {
     // code-rot detector issues (registry order) first, then security findings
     // (security-validation check-execution order).
     let securitySummary = SECURITY_AUDIT_NOT_RUN_SUMMARY;
+    let androidSummary = ANDROID_AUDIT_NOT_REQUESTED_SUMMARY;
     if (config.types.includes("security")) {
-        const securityAudit = await runSecurityAuditAdapter({ toolRoot, config });
+        const securityAudit = await runSecurityAuditAdapter({ toolRoot, config, android: config.android ? { enabled: true } : undefined }, options.securityDependencies);
         issues.push(...securityAudit.issues);
         securitySummary = securityAudit.summary;
+        androidSummary = securityAudit.android;
     }
     const issueCounts = countIssuesBySeverity(issues);
     const { exitCode, reason } = calculateAuditExitCode(issues, config.failOn);
@@ -64,6 +66,7 @@ export async function runAudit(options) {
             failOn: config.failOn,
             out: config.out,
             isDefaultRun: config.isDefaultRun,
+            android: config.android,
         },
         targetSummary: {
             rootPath: target.rootPath,
@@ -81,6 +84,7 @@ export async function runAudit(options) {
         sourceFacts,
         pythonProjectMetadata,
         securitySummary,
+        androidSummary,
         noDetectorsRegistered: selected.length === 0,
     };
 }

package/dist/src/audits/report/auditReportModel.js

@@ -166,6 +166,7 @@ export function buildAuditReportModel(result, opts) {
             failOn: result.configSummary.failOn,
             out: result.configSummary.out,
             isDefaultRun: result.configSummary.isDefaultRun,
+            android: result.configSummary.android,
         },
         summary: {
             totalIssues: issues.length,
@@ -191,6 +192,10 @@ export function buildAuditReportModel(result, opts) {
         sourceFacts: summarizeSourceFacts(result.sourceFacts),
         pythonProjectMetadata: result.pythonProjectMetadata,
         securitySummary: result.securitySummary,
+        androidSecurity: {
+            summary: result.androidSummary,
+            candidates: result.androidSummary.candidateSummary,
+        },
         detectors,
         issues,
         skippedDetectors: result.skippedDetectors,
@@ -252,5 +257,7 @@ function reconstructCommand(result) {
         parts.push("--format", cfg.formats.join(","));
     parts.push("--fail-on", cfg.failOn);
     parts.push("--out", cfg.out);
+    if (cfg.android)
+        parts.push("--android");
     return parts.join(" ");
 }

package/dist/src/audits/report/renderAuditJsonReport.js

@@ -21,6 +21,7 @@ export function renderAuditJsonReport(model) {
         sourceFacts: model.sourceFacts,
         pythonProjectMetadata: model.pythonProjectMetadata,
         securitySummary: model.securitySummary,
+        androidSecurity: model.androidSecurity,
         detectors: model.detectors,
         issues: model.issues,
         skippedDetectors: model.skippedDetectors,

package/dist/src/audits/report/renderAuditTextReport.js

@@ -133,6 +133,43 @@ export function renderAuditTextReport(model) {
         }
     }
     lines.push("");
+    // v0.4.2 Batch 3 -- bounded summary only, mirroring the "Security
+    // validation summary" section above exactly. Confirmed mapped Android
+    // findings are NOT re-listed here -- they already appear in the "Issues"
+    // section below like any other AuditIssue (see spec section 12: "the
+    // existing generic issues section remains the detailed presentation for
+    // confirmed mapped Android findings"). CandidateEvidence bodies never
+    // appear here either -- only counts, with a pointer to the full Android
+    // report for detail.
+    lines.push("Android security validation summary");
+    lines.push(divider("-"));
+    if (!model.androidSecurity.summary.requested) {
+        lines.push("  (not requested -- add --android alongside --types security to include it)");
+    }
+    else {
+        const android = model.androidSecurity.summary;
+        const candidates = model.androidSecurity.candidates;
+        const applicabilityNote = android.applicable === false ? " (target is not an Android project)" : "";
+        lines.push(`  Status: ${android.status}${applicabilityNote}`);
+        lines.push(`  Verdict: ${android.verdict ?? "(unknown)"}`);
+        lines.push(`  Checks: total=${android.totalChecks} passed=${android.passedChecks} withFindings=${android.checksWithFindings} candidateOnly=${android.candidateOnlyChecks} skipped=${android.skippedChecks} inconclusive=${android.inconclusiveChecks} failed=${android.failedChecks}`);
+        lines.push(`  Findings: confirmed=${android.confirmedFindingCount} mappedIssues=${android.mappedIssueCount}`);
+        lines.push(`  Candidates (review evidence, not confirmed vulnerabilities): total=${candidates.totalCount} checksWithCandidates=${candidates.checksWithCandidates}`);
+        if (android.warnings.length > 0) {
+            lines.push(`  Warnings: ${android.warnings.length}`);
+        }
+        if (android.errors.length > 0) {
+            lines.push(`  Errors: ${android.errors.length}`);
+            for (const e of android.errors.slice(0, 5)) {
+                lines.push(`    ${sanitizeLine(e)}`);
+            }
+        }
+        if (android.reportPaths.text || android.reportPaths.json) {
+            lines.push(`  Full report: ${android.reportPaths.text ?? "(none)"} / ${android.reportPaths.json ?? "(none)"}`);
+        }
+        lines.push("  Static analysis only -- does not prove runtime behavior, APK/AAB validity, Play compliance, or pentest results.");
+    }
+    lines.push("");
     lines.push("Issue summary");
     lines.push(divider("-"));
     lines.push(`  Total issues: ${model.summary.totalIssues}`);

package/dist/src/audits/security/androidAuditIntegration.js

@@ -0,0 +1,145 @@
+import path from "node:path";
+import { validateAndroidTarget } from "../../mobile/android/validate/validateAndroidTarget.js";
+import { toAndroidReportModel } from "../../mobile/android/report/model.js";
+import { writeAndroidReportFiles } from "../../mobile/android/report/writeAndroidReportFiles.js";
+import { reportFilenamePrefix } from "../../securityValidation/validate/resolveTarget.js";
+import { mapAndroidSecurityFindingToAuditIssue } from "./mapAndroidSecurityFindingToAuditIssue.js";
+import { ANDROID_AUDIT_NOT_REQUESTED_SUMMARY, EMPTY_ANDROID_AUDIT_CANDIDATE_SUMMARY, } from "./securityAuditTypes.js";
+const ANDROID_REPORT_SUBDIR = "android";
+// Bounded, redacted — never the thrown value's stack, never raw child-process
+// output (there is none at this boundary; validateAndroidTarget itself never
+// spawns a process unless Gradle/external-tool options are requested, which
+// Batch 2 never supplies).
+const MAX_ANDROID_ERROR_MESSAGE_LENGTH = 500;
+function boundErrorMessage(message) {
+    return message.length <= MAX_ANDROID_ERROR_MESSAGE_LENGTH
+        ? message
+        : `${message.slice(0, MAX_ANDROID_ERROR_MESSAGE_LENGTH)}... [truncated, ${message.length} chars total]`;
+}
+function failedSummary(errorMessage) {
+    return {
+        ...ANDROID_AUDIT_NOT_REQUESTED_SUMMARY,
+        requested: true,
+        applicable: null,
+        status: "failed",
+        errors: [boundErrorMessage(errorMessage)],
+    };
+}
+// Exact-duplicate dedupe by AuditIssue id only, first occurrence wins —
+// mirrors validateAndroidTarget's own findingsById convention. Iterates
+// checks in their own fixed order (never re-sorted) and each check's own
+// findings in their own order — never the top-level, already-flattened
+// result.findings, which has lost per-check identity this mapper needs as
+// context. Exported standalone so aggregation correctness (ordering,
+// dedup, provenance) can be tested against small literal AndroidCheckResult
+// fixtures without needing a full AndroidValidationResult.
+export function aggregateAndroidIssues(checks, reportReference) {
+    const issuesById = new Map();
+    for (const check of checks) {
+        for (const finding of check.findings) {
+            const issue = mapAndroidSecurityFindingToAuditIssue(finding, {
+                checkId: check.id,
+                checkCategory: check.category,
+                checkConfidence: check.confidence,
+                reportReference,
+            });
+            if (!issuesById.has(issue.id)) {
+                issuesById.set(issue.id, issue);
+            }
+        }
+    }
+    return [...issuesById.values()];
+}
+export function buildCandidateSummary(checks) {
+    const byConfidence = { ...EMPTY_ANDROID_AUDIT_CANDIDATE_SUMMARY.byConfidence };
+    const byResolutionState = { ...EMPTY_ANDROID_AUDIT_CANDIDATE_SUMMARY.byResolutionState };
+    const byCategory = {};
+    let totalCount = 0;
+    let checksWithCandidates = 0;
+    for (const check of checks) {
+        const candidates = check.candidateEvidence ?? [];
+        if (candidates.length === 0)
+            continue;
+        checksWithCandidates += 1;
+        for (const candidate of candidates) {
+            totalCount += 1;
+            byConfidence[candidate.confidence] += 1;
+            byResolutionState[candidate.resolutionState] += 1;
+            byCategory[candidate.category] = (byCategory[candidate.category] ?? 0) + 1;
+        }
+    }
+    // Deterministic key order regardless of check/candidate traversal order.
+    const sortedByCategory = Object.fromEntries(Object.entries(byCategory).sort(([a], [b]) => a.localeCompare(b)));
+    return { totalCount, checksWithCandidates, byConfidence, byResolutionState, byCategory: sortedByCategory };
+}
+export async function runAndroidAuditIntegration(options) {
+    const runAndroidValidation = options.runAndroidValidation ?? validateAndroidTarget;
+    let result;
+    try {
+        result = await runAndroidValidation({
+            toolRoot: options.toolRoot,
+            targetPath: options.targetPathArg,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { issues: [], summary: failedSummary(`Android validation failed to run: ${message}`) };
+    }
+    const isApplicable = result.detection.projectKind !== "non-android";
+    const reportModel = toAndroidReportModel(result, { profile: "android" });
+    const reportDir = path.join(options.toolRoot, "reports", "security", ANDROID_REPORT_SUBDIR);
+    const prefix = reportFilenamePrefix({
+        isSelf: result.target.local.isSelf,
+        packageName: result.target.local.packageName,
+        packageVersion: result.target.local.packageVersion,
+        targetRoot: result.target.local.targetRoot,
+    });
+    let reportPaths;
+    let writeErrors = [];
+    try {
+        const written = writeAndroidReportFiles({ outDir: reportDir, prefix, report: reportModel, formats: ["text", "json"] });
+        reportPaths = { text: written.textPath, json: written.jsonPath };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        reportPaths = { text: null, json: null };
+        writeErrors = [boundErrorMessage(`Failed to write Android report files: ${message}`)];
+    }
+    const issues = aggregateAndroidIssues(result.checks, reportPaths);
+    const passedChecks = result.checks.filter((c) => c.status === "passed").length;
+    const skippedChecks = result.checks.filter((c) => c.status === "skipped").length;
+    const inconclusiveChecks = result.checks.filter((c) => c.status === "inconclusive").length;
+    const failedChecks = result.checks.filter((c) => c.status === "failed" || c.status === "error").length;
+    const checksWithFindings = result.checks.filter((c) => c.findings.length > 0).length;
+    const candidateOnlyChecks = result.checks.filter((c) => c.findings.length === 0 && (c.candidateEvidence?.length ?? 0) > 0).length;
+    const candidateEvidenceCount = result.checks.reduce((sum, c) => sum + (c.candidateEvidence?.length ?? 0), 0);
+    const summary = {
+        requested: true,
+        applicable: isApplicable,
+        status: "completed",
+        verdict: result.verdict,
+        totalChecks: result.checks.length,
+        passedChecks,
+        checksWithFindings,
+        candidateOnlyChecks,
+        skippedChecks,
+        inconclusiveChecks,
+        failedChecks,
+        confirmedFindingCount: result.findings.length,
+        mappedIssueCount: issues.length,
+        candidateEvidenceCount,
+        // No Gradle/external-tool programmatic passthrough exists yet in Batch 2
+        // (see securityAuditTypes.ts's AndroidAuditSummary comment) — the default
+        // request always executes zero of either.
+        requestedGradleOperationCount: 0,
+        executedGradleOperationCount: 0,
+        requestedExternalToolCount: 0,
+        executedExternalToolCount: 0,
+        skippedExternalToolCount: 0,
+        reportPaths,
+        warnings: result.warnings,
+        errors: [...result.errors, ...writeErrors],
+        candidateSummary: buildCandidateSummary(result.checks),
+    };
+    return { issues, summary };
+}

package/dist/src/audits/security/mapAndroidSecurityFindingToAuditIssue.js

@@ -0,0 +1,116 @@
+import { makeAuditEvidence } from "../core/auditIssue.js";
+import { isBlockingSecuritySeverity, mapSecuritySeverityToAuditSeverity } from "./mapSecurityFindingToAuditIssue.js";
+// ---------------------------------------------------------------------------
+// v0.4.2 Batch 1 — pure Android SecurityFinding -> AuditIssue mapper.
+//
+// Android checks already reuse SecurityFinding as-is (see
+// src/mobile/android/audit/androidFinding.ts's own header comment) — there is
+// no parallel "AndroidSecurityFinding" type. What Android findings lose by
+// reusing the generic SecurityFinding shape is per-family taxonomy: every
+// Android finding's own `category` is the single shared value "static-scan"
+// (a SecurityCheckCategory), while the *specific* Android family (backup,
+// secrets, webview, ...) only lives on the owning AndroidCheckResult.category.
+// This mapper therefore takes a small AndroidAuditMappingContext alongside
+// the finding — supplied by the (future Batch 2) caller that already has the
+// owning AndroidCheckResult in hand — rather than trying to recover that
+// context by parsing the finding's own opaque id/evidence text.
+//
+// Reuses mapSecurityFindingToAuditIssue's severity/blocking policy exactly
+// (SecuritySeverity is the same shared type for Android and non-Android
+// findings) instead of defining a second severity table. Pure, no I/O, no
+// mutation, no CandidateEvidence handling — CandidateEvidence is a distinct
+// type (see src/mobile/android/advancedSecurity/candidateEvidence.ts) and
+// cannot be passed here at all: this function's parameter type is
+// SecurityFinding, not CandidateEvidence.
+// ---------------------------------------------------------------------------
+export const ANDROID_SECURITY_AUDIT_DETECTOR_ID = "android-security-validation-adapter";
+const DEFAULT_CONFIDENCE = "medium";
+const DEFAULT_FALSE_POSITIVE_RISK = "medium";
+// MobileConfidence carries an extra "unknown" state SecurityFinding-derived
+// AuditConfidence has no equivalent for; mapped to the same conservative
+// "medium" default the generic security mapper uses when no per-finding
+// confidence exists at all, rather than inventing a fourth AuditConfidence
+// value.
+function mapCheckConfidenceToAuditConfidence(confidence) {
+    if (confidence === "high" || confidence === "medium" || confidence === "low")
+        return confidence;
+    return DEFAULT_CONFIDENCE;
+}
+// makeAndroidFinding (src/mobile/android/audit/androidFinding.ts) is the sole
+// place Android findings compose their `evidence` string, always in the exact
+// form `location=<relativePath>(:<line>)?` (optionally followed by further
+// ` | `-joined detail segments). Extracting the line from that well-known,
+// single-producer format is not fabricating a source position — it is
+// reading a real value the same codebase already wrote, deterministically.
+// Guarded so a value is only trusted when its path matches the finding's own
+// affectedFiles[0]; anything else is left absent rather than guessed.
+const LOCATION_EVIDENCE_PATTERN = /(?:^|\s\|\s)location=([^\s|]+)/;
+function extractAndroidFindingLine(finding) {
+    if (!finding.evidence)
+        return undefined;
+    const relativePath = finding.affectedFiles?.[0];
+    if (!relativePath)
+        return undefined;
+    const match = LOCATION_EVIDENCE_PATTERN.exec(finding.evidence);
+    if (!match)
+        return undefined;
+    const [locationPath, lineText] = match[1].split(":");
+    if (locationPath !== relativePath || lineText === undefined)
+        return undefined;
+    const line = Number(lineText);
+    return Number.isInteger(line) && line > 0 ? line : undefined;
+}
+export function mapAndroidSecurityFindingToAuditIssue(finding, context) {
+    const severity = mapSecuritySeverityToAuditSeverity(finding.severity);
+    const isBlockingSeverity = isBlockingSecuritySeverity(finding.severity);
+    const relativePath = finding.affectedFiles?.[0];
+    const line = extractAndroidFindingLine(finding);
+    const provenanceSuffix = context.externalToolId ? `, tool=${context.externalToolId}` : "";
+    const evidence = finding.evidence
+        ? [
+            makeAuditEvidence({
+                kind: "observation",
+                message: `Android security validation (${context.checkId}${provenanceSuffix}): ${finding.title}`,
+                excerpt: finding.evidence,
+                filePath: relativePath,
+                line,
+                source: `android-security-validation:${context.checkId}`,
+                confidence: mapCheckConfidenceToAuditConfidence(context.checkConfidence),
+            }),
+        ]
+        : [];
+    const reportPath = context.reportReference?.json ?? context.reportReference?.text ?? undefined;
+    if (reportPath) {
+        evidence.push(makeAuditEvidence({
+            kind: "reference",
+            message: "Original Android security-validation report",
+            filePath: reportPath,
+            source: "android-security-validation:report",
+            confidence: DEFAULT_CONFIDENCE,
+        }));
+    }
+    return {
+        id: `android:${context.checkId}:${finding.id}`,
+        auditType: "security",
+        detectorId: ANDROID_SECURITY_AUDIT_DETECTOR_ID,
+        title: finding.title,
+        description: finding.description,
+        severity,
+        confidence: mapCheckConfidenceToAuditConfidence(context.checkConfidence),
+        falsePositiveRisk: DEFAULT_FALSE_POSITIVE_RISK,
+        // Deliberately the Android-specific check category (e.g.
+        // "android-backup-configuration"), not finding.category — every Android
+        // finding's own `category` is the single shared "static-scan" value, so
+        // reusing it here would make every mapped Android issue's category
+        // uselessly uniform. See module header comment.
+        category: context.checkCategory,
+        evidence,
+        affectedFiles: finding.affectedFiles ?? [],
+        recommendedAction: finding.recommendation ?? "Review the Android security validation report for remediation guidance.",
+        suggestedFixStrategy: finding.recommendation ?? "See the linked Android security validation report for details.",
+        validationCommands: ["npm run security:validate -- --profile android"],
+        releaseBlocking: isBlockingSeverity,
+        implementationBlocking: isBlockingSeverity,
+        autoFixEligible: false,
+    };
+}

package/dist/src/audits/security/mapSecurityFindingToAuditIssue.js

@@ -31,12 +31,22 @@ const SEVERITY_MAP = {
 // false positives) nor discounts it as unreliable.
 const DEFAULT_CONFIDENCE = "medium";
 const DEFAULT_FALSE_POSITIVE_RISK = "medium";
+// Exported so other SecurityFinding-consuming mappers (e.g. the Android
+// audit-adapter mapper, v0.4.2 Batch 1) reuse the same conservative
+// severity policy instead of defining a second one.
+export function mapSecuritySeverityToAuditSeverity(severity) {
+    return SEVERITY_MAP[severity];
+}
+// Mirrors verdict.ts's calculateVerdict: blocker and major findings are what
+// drive a "not-ready-security-blocker-remains" verdict — minor/informational
+// findings never block release or implementation on their own. Exported for
+// reuse by other SecurityFinding-consuming mappers.
+export function isBlockingSecuritySeverity(severity) {
+    return severity === "blocker" || severity === "major";
+}
 export function mapSecurityFindingToAuditIssue(finding) {
-    const severity = SEVERITY_MAP[finding.severity];
-    // Mirrors verdict.ts's calculateVerdict: blocker and major findings are
-    // what drive a "not-ready-security-blocker-remains" verdict — minor/
-    // informational findings never block release or implementation on their own.
-    const isBlockingSeverity = finding.severity === "blocker" || finding.severity === "major";
+    const severity = mapSecuritySeverityToAuditSeverity(finding.severity);
+    const isBlockingSeverity = isBlockingSecuritySeverity(finding.severity);
     const evidence = finding.evidence
         ? [
             makeAuditEvidence({

package/dist/src/audits/security/securityAuditAdapter.js

@@ -6,7 +6,9 @@ import { writeSecurityReportFiles } from "../../securityValidation/report/writeS
 import { DEFAULT_SECURITY_CHECKS, DEFAULT_SECURITY_PROFILE } from "../../securityValidation/validate/cliOptions.js";
 import { verdictToHumanLabel } from "../../securityValidation/validate/verdict.js";
 import { mapSecurityFindingToAuditIssue } from "./mapSecurityFindingToAuditIssue.js";
-export async function runSecurityAuditAdapter(options) {
+import { runAndroidAuditIntegration } from "./androidAuditIntegration.js";
+import { ANDROID_AUDIT_NOT_REQUESTED_SUMMARY, } from "./securityAuditTypes.js";
+export async function runSecurityAuditAdapter(options, dependencies = {}) {
     const { toolRoot, config } = options;
     const summary = await runSecurityValidation({
         cwd: toolRoot,
@@ -60,7 +62,23 @@ export async function runSecurityAuditAdapter(options) {
         verdictReasonSummary: summary.verdictReasonSummary ?? null,
         reportPaths: { text: textPath, json: jsonPath },
     };
-    return { issues, summary: securitySummary };
+    // v0.4.2 Batch 2 — Android integration is strictly additive: existing
+    // non-Android issues/summary above are computed identically whether or not
+    // Android is requested, and Android issues are always appended after them,
+    // never interleaved or reordered.
+    let androidIssues = [];
+    let androidSummary = ANDROID_AUDIT_NOT_REQUESTED_SUMMARY;
+    if (options.android?.enabled) {
+        const androidResult = await runAndroidAuditIntegration({
+            toolRoot,
+            targetPathArg: config.targetPathArg,
+            request: options.android,
+            runAndroidValidation: dependencies.runAndroidValidation,
+        });
+        androidIssues = androidResult.issues;
+        androidSummary = androidResult.summary;
+    }
+    return { issues: [...issues, ...androidIssues], summary: securitySummary, android: androidSummary };
 }
 function buildRunScopedReportSuffix(startedAt, finishedAt) {
     return `${sanitizeTimestamp(startedAt)}-${sanitizeTimestamp(finishedAt)}-${process.pid}`;

package/dist/src/audits/security/securityAuditTypes.js

@@ -15,3 +15,40 @@ export const SECURITY_AUDIT_NOT_RUN_SUMMARY = {
     verdictReasonSummary: null,
     reportPaths: { text: null, json: null },
 };
+// Mirrors SecurityAuditReportSummary's own `ran`-first, always-present
+// convention: a status literal rather than inferring "did it run" from
+// nullable fields, so callers/tests can switch on one value instead of
+// reconstructing a state machine from several optional fields.
+export const ANDROID_AUDIT_STATUSES = ["not-requested", "not-applicable", "completed", "failed"];
+export const EMPTY_ANDROID_AUDIT_CANDIDATE_SUMMARY = {
+    totalCount: 0,
+    checksWithCandidates: 0,
+    byConfidence: { unknown: 0, low: 0, medium: 0, high: 0 },
+    byResolutionState: { resolved: 0, unresolved: 0, missing: 0, malformed: 0, unsupported: 0, "not-applicable": 0 },
+    byCategory: {},
+};
+export const ANDROID_AUDIT_NOT_REQUESTED_SUMMARY = {
+    requested: false,
+    applicable: null,
+    status: "not-requested",
+    verdict: null,
+    totalChecks: 0,
+    passedChecks: 0,
+    checksWithFindings: 0,
+    candidateOnlyChecks: 0,
+    skippedChecks: 0,
+    inconclusiveChecks: 0,
+    failedChecks: 0,
+    confirmedFindingCount: 0,
+    mappedIssueCount: 0,
+    candidateEvidenceCount: 0,
+    requestedGradleOperationCount: 0,
+    executedGradleOperationCount: 0,
+    requestedExternalToolCount: 0,
+    executedExternalToolCount: 0,
+    skippedExternalToolCount: 0,
+    reportPaths: { text: null, json: null },
+    warnings: [],
+    errors: [],
+    candidateSummary: EMPTY_ANDROID_AUDIT_CANDIDATE_SUMMARY,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dailephd/my-dev-kit-lab",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "type": "module",
   "description": "Evidence, benchmark, and evaluation companion for my-dev-kit.",
   "bin": {