@ngocsangairvds/vsaf 3.2.14 → 3.2.15

package/tools/vds-scripts/audit_orchestrator/tests/test_publishers/test_confluence_publisher.py

@@ -1,2171 +0,0 @@
-"""Tests for Confluence publisher update behavior."""
-
-from __future__ import annotations
-
-import json
-from pathlib import Path
-
-import pytest
-from vds_audit_orchestrator.errors import DataSourceError
-from vds_audit_orchestrator.publishers.confluence_publisher import ConfluencePublisher
-
-
-class _FakeClient:
-    def __init__(self) -> None:
-        self.update_page_calls: list[dict[str, object]] = []
-        self.update_attachment_calls: list[dict[str, object]] = []
-        self.upload_attachment_calls: list[dict[str, object]] = []
-        self.create_page_calls: list[dict[str, object]] = []
-        self.is_degraded: bool = False
-        self.attachments: list[dict[str, object]] = [
-            {"id": "att-1", "title": "report.json"},
-            {"id": "att-2", "title": "findings.xlsx"},
-        ]
-        self.pages: dict[str, dict[str, object]] = {
-            "parent-1": {"id": "parent-1", "title": "Parent", "parent_id": None, "space_key": "VDS"},
-            "analysis-root-1": {
-                "id": "analysis-root-1",
-                "title": "Project Analysis - parent-1",
-                "parent_id": "parent-1",
-                "space_key": "VDS",
-            },
-            "run-1": {"id": "run-1", "title": "Run 1", "parent_id": "analysis-root-1", "space_key": "VDS"},
-        }
-        self.current_body = (
-            "<!-- VDS:SECTION:summary:START --><p>old summary</p><!-- VDS:SECTION:summary:END -->"
-            "<!-- VDS:SECTION:top_findings:START --><p>old findings</p><!-- VDS:SECTION:top_findings:END -->"
-            "<!-- VDS:SECTION:priority_actions:START --><p>old priority</p><!-- VDS:SECTION:priority_actions:END -->"
-            "<!-- VDS:SECTION:checklist_core:START --><p>old checklist core</p><!-- VDS:SECTION:checklist_core:END -->"
-            "<!-- VDS:SECTION:checklist_details:START --><p>old checklist details</p><!-- VDS:SECTION:checklist_details:END -->"
-        )
-        self.current_title = "Run 1"
-        self.get_content_page_expands: list[str | None] = []
-
-    async def search_cql(self, cql: str, limit: int = 25, start: int = 0) -> list[dict[str, object]]:
-        import re
-
-        parent_match = re.search(r"parent=([^\s]+)", cql)
-        space_match = re.search(r'space="([^"]+)"', cql)
-        title_match = re.search(r'title="([^"]+)"', cql)
-        parent_id = parent_match.group(1) if parent_match else None
-        space_key = space_match.group(1) if space_match else None
-        title = title_match.group(1) if title_match else None
-        if not title:
-            return []
-        matches: list[dict[str, object]] = []
-        for page in self.pages.values():
-            if page.get("title") != title:
-                continue
-            if parent_id is not None and page.get("parent_id") != parent_id:
-                continue
-            if space_key is not None and page.get("space_key") != space_key:
-                continue
-            matches.append({"id": page.get("id")})
-        return matches[:limit]
-
-    async def get_content_page(self, page_id: str, *, expand: str | None = None) -> dict[str, object]:
-        self.get_content_page_expands.append(expand)
-        page = self.pages.get(page_id, {"title": self.current_title, "space_key": "VDS"})
-        return {
-            "id": page_id,
-            "title": page.get("title", self.current_title),
-            "version": {"number": 5},
-            "space": {"key": page.get("space_key", "VDS")},
-            "body": {"storage": {"value": self.current_body}},
-        }
-
-    async def create_page(
-        self,
-        *,
-        space_key: str,
-        title: str,
-        body_file: Path,
-        parent_id: str | None = None,
-    ) -> dict[str, object]:
-        created_id = f"new-page-{len(self.create_page_calls) + 1}"
-        self.create_page_calls.append(
-            {"space_key": space_key, "title": title, "body_file": body_file, "parent_id": parent_id, "id": created_id}
-        )
-        self.pages[created_id] = {
-            "id": created_id,
-            "title": title,
-            "parent_id": parent_id,
-            "space_key": space_key,
-        }
-        return {"id": created_id}
-
-    async def create_or_update_page(
-        self,
-        *,
-        space_key: str,
-        title: str,
-        body_file: Path,
-        parent_id: str | None = None,
-    ) -> dict[str, object]:
-        """Delegates to create_page for test purposes (upsert semantics)."""
-        for page in self.pages.values():
-            if page.get("parent_id") == parent_id and page.get("title") == title:
-                return {"id": page.get("id")}
-        return await self.create_page(
-            space_key=space_key,
-            title=title,
-            body_file=body_file,
-            parent_id=parent_id,
-        )
-
-    async def update_page(
-        self,
-        page_id: str,
-        *,
-        title: str | None = None,
-        body_file: Path | None = None,
-        version: int | None = None,
-    ) -> dict[str, object]:
-        if body_file and body_file.exists():
-            self.current_body = body_file.read_text(encoding="utf-8")
-        self.update_page_calls.append({"page_id": page_id, "title": title, "body_file": body_file, "version": version})
-        return {"id": page_id}
-
-    async def list_attachments(self, page_id: str) -> list[dict[str, object]]:
-        return list(self.attachments)
-
-    async def update_attachment(
-        self,
-        *,
-        page_id: str,
-        attachment_id: str,
-        file_path: Path,
-    ) -> dict[str, object]:
-        self.update_attachment_calls.append(
-            {"page_id": page_id, "attachment_id": attachment_id, "file_path": file_path}
-        )
-        return {"id": attachment_id}
-
-    async def upload_attachment(self, *, page_id: str, file_path: Path) -> dict[str, object]:
-        self.upload_attachment_calls.append({"page_id": page_id, "file_path": file_path})
-        return {"id": "new-attachment"}
-
-    async def get_page(self, page_id: str, *, expand: str | None = None) -> dict[str, object] | None:
-        body: dict[str, object] = {}
-        if expand and "body.storage" in expand:
-            body = {"storage": {"value": self.current_body}}
-        return {"id": page_id, "title": self.current_title, "body": body, "version": {"number": 5}}
-
-
-@pytest.mark.asyncio
-async def test_upload_results_updates_existing_run_page(tmp_path):
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    markdown = report_dir / "report.md"
-    markdown.write_text("# Report\n\nContent.", encoding="utf-8")
-    (report_dir / "report.json").write_text("{}", encoding="utf-8")
-    (report_dir / "findings.xlsx").write_bytes(b"fake")
-    (report_dir / "audit-checklist.xlsx").write_bytes(b"checklist")
-
-    client = _FakeClient()
-    publisher = ConfluencePublisher(client)
-
-    result = await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=True,
-    )
-
-    assert result.page_id == "run-1"
-    run_page_creates = [call for call in client.create_page_calls if call.get("title") == "Run 1"]
-    assert run_page_creates == []
-    assert len(client.update_page_calls) == 1
-    assert client.update_page_calls[0]["page_id"] == "run-1"
-    assert client.update_page_calls[0]["version"] == 6
-    assert len(client.update_attachment_calls) == 2
-    assert len(client.upload_attachment_calls) == 1
-    assert client.upload_attachment_calls[0]["file_path"].name == "audit-checklist.xlsx"
-    assert set(result.attachments) == {"att-1", "att-2", "new-attachment"}
-
-    body_path = client.update_page_calls[0]["body_file"]
-    assert isinstance(body_path, Path)
-    html = body_path.read_text(encoding="utf-8")
-    # Always include the attachments macro so Confluence can render the current list.
-    assert 'ac:name="attachments"' in html
-
-
-@pytest.mark.asyncio
-async def test_update_run_page_omits_unchanged_title(tmp_path):
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    markdown = report_dir / "report.md"
-    markdown.write_text("# Report\n\nContent.", encoding="utf-8")
-
-    client = _FakeClient()
-    client.current_title = "Run 1"
-    publisher = ConfluencePublisher(client)
-
-    await publisher.update_run_page(
-        page_id="run-1",
-        title="Run 1",
-        report_dir=report_dir,
-        markdown_path=markdown,
-    )
-
-    assert len(client.update_page_calls) == 1
-    assert client.update_page_calls[0]["title"] is None
-    assert client.get_content_page_expands[-1] == "title,version"
-
-
-@pytest.mark.asyncio
-async def test_update_run_page_incremental_omits_unchanged_title(tmp_path):
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    markdown = report_dir / "report.md"
-    markdown.write_text("# Report\n\nContent.", encoding="utf-8")
-    (report_dir / "workflow-summary.json").write_text(
-        '{"agent_results":[{"agent":"SecurityAgent","findings":[{"type":"security","description":"X","location":"Y"}]}]}',
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.json").write_text(
-        json.dumps(
-            {
-                "checklist_version": "1.0.0",
-                "generated_at": "2026-03-11T00:00:00Z",
-                "template_name": "VDS Checklist",
-                "template_version": "1.0",
-                "template_hash": "th",
-                "template_row_count": 0,
-                "repository": "test-repo",
-                "row_llm_mode": "selective",
-                "evidence_hash": "eh",
-                "rows": [],
-            }
-        ),
-        encoding="utf-8",
-    )
-
-    client = _FakeClient()
-    client.current_title = "Run 1"
-    publisher = ConfluencePublisher(client)
-
-    updated, reason = await publisher.update_run_page_incremental(
-        page_id="run-1",
-        title="Run 1",
-        report_dir=report_dir,
-        markdown_path=markdown,
-    )
-
-    assert updated is True
-    assert reason is None
-    assert len(client.update_page_calls) == 1
-    assert client.update_page_calls[0]["title"] is None
-    assert client.get_content_page_expands[-1] == "body.storage,version"
-
-
-@pytest.mark.asyncio
-async def test_upload_results_defaults_checklist_details_expanded(tmp_path):
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "report.md").write_text("# Report\n\nContent.", encoding="utf-8")
-    (report_dir / "audit-checklist.json").write_text(
-        json.dumps(
-            {
-                "checklist_version": "1.0.0",
-                "generated_at": "2026-03-11T00:00:00Z",
-                "template_name": "VDS Checklist",
-                "template_version": "1.0",
-                "template_hash": "th",
-                "template_row_count": 1,
-                "repository": "test-repo",
-                "row_llm_mode": "selective",
-                "evidence_hash": "eh",
-                "rows": [
-                    {
-                        "row_id": "CL-001:row_0",
-                        "row_index": 0,
-                        "check_id": "CL-001",
-                        "requirement_text": "Test requirement",
-                        "weight_raw": 10.0,
-                        "weight_adjusted": 10.0,
-                        "status": "PASS",
-                        "score_breakdown": {"raw_score": 95.0, "final_score": 95.0},
-                        "evidence_refs": [
-                            {
-                                "ref_type": "file_path",
-                                "ref_value": "src/app.py",
-                                "label": "src/app.py",
-                            }
-                        ],
-                        "reason": "OK",
-                        "finding": "Found",
-                        "provenance": {
-                            "row_llm_mode": "selective",
-                            "evaluated_at": "2026-03-11T00:00:00Z",
-                            "template_hash": "th",
-                            "evidence_hash": "eh",
-                        },
-                    }
-                ],
-            }
-        ),
-        encoding="utf-8",
-    )
-
-    client = _FakeClient()
-    publisher = ConfluencePublisher(client)
-
-    await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=False,
-    )
-
-    body_path = client.update_page_calls[0]["body_file"]
-    assert isinstance(body_path, Path)
-    html = body_path.read_text(encoding="utf-8")
-    assert "<h2>Chi tiết lý do và minh chứng</h2>" in html
-    assert 'ac:name="expand"' not in html
-    assert "<th>Minh chứng</th>" in html
-
-
-@pytest.mark.asyncio
-async def test_upload_results_renders_top_findings_table_with_provenance(tmp_path):
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    markdown = report_dir / "report.md"
-    markdown.write_text("# Report\n\nContent.", encoding="utf-8")
-    (report_dir / "workflow-summary.json").write_text(
-        """
-        {
-          "agent_results": [
-            {
-              "agent": "SecurityAgent",
-              "success": true,
-              "findings": [
-                {"type": "security_vulnerability", "description": "Hardcoded credential", "location": "src/app.py"}
-              ]
-            }
-          ],
-          "synthesis": {"status": "complete"}
-        }
-        """.strip(),
-        encoding="utf-8",
-    )
-
-    client = _FakeClient()
-    publisher = ConfluencePublisher(client)
-
-    await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=True,
-    )
-
-    assert len(client.update_page_calls) == 1
-    assert len(client.upload_attachment_calls) == 1
-    assert client.upload_attachment_calls[0]["file_path"].name == "workflow-summary.json"
-    body_path = client.update_page_calls[0]["body_file"]
-    assert isinstance(body_path, Path)
-    html = body_path.read_text(encoding="utf-8")
-    assert "Top Findings (Checklist)" in html
-    assert "Hardcoded credential" in html
-    assert "SecurityAgent / security_vulnerability" in html
-    # Provenance references the workflow summary attachment by filename.
-    assert "workflow-summary.json" in html
-
-
-@pytest.mark.asyncio
-async def test_upload_results_extracts_top_findings_from_audit_checklist_xlsx(tmp_path):
-    from openpyxl import Workbook
-
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "report.md").write_text("# Report\n\nContent.", encoding="utf-8")
-
-    wb = Workbook()
-    ws = wb.active
-    ws.title = "Checklist"
-    ws.append(["Severity", "Status", "Finding", "Location", "Provenance"])
-    ws.append(["High", "Failed", "Missing threat model", "docs/SECURITY.md", "SecurityAgent"])
-    xlsx_path = report_dir / "audit-checklist.xlsx"
-    wb.save(xlsx_path)
-
-    client = _FakeClient()
-    publisher = ConfluencePublisher(client)
-
-    await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=True,
-    )
-
-    assert len(client.update_page_calls) == 1
-    assert len(client.upload_attachment_calls) == 1
-    assert client.upload_attachment_calls[0]["file_path"].name == "audit-checklist.xlsx"
-
-    body_path = client.update_page_calls[0]["body_file"]
-    assert isinstance(body_path, Path)
-    html = body_path.read_text(encoding="utf-8")
-    assert "Top Findings (Checklist)" in html
-    assert "Missing threat model" in html
-    assert "docs/SECURITY.md" in html
-    assert "SecurityAgent" in html
-
-
-@pytest.mark.asyncio
-async def test_upload_results_extracts_top_findings_from_markdown_when_other_sources_missing(tmp_path):
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "report.md").write_text(
-        "\n".join(
-            [
-                "# Report",
-                "",
-                "## Top Findings",
-                "",
-                "- `CL-001` `FAIL` `27.00`",
-                "- `CL-004` `PARTIAL` `76.50`",
-                "",
-                "## Critique Summary",
-                "",
-                "- enabled: `True`",
-            ]
-        ),
-        encoding="utf-8",
-    )
-    (report_dir / "workflow-summary.json").write_text('{"synthesis": {"status": "complete"}}', encoding="utf-8")
-
-    client = _FakeClient()
-    publisher = ConfluencePublisher(client)
-
-    await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=True,
-    )
-
-    body_path = client.update_page_calls[0]["body_file"]
-    assert isinstance(body_path, Path)
-    html = body_path.read_text(encoding="utf-8")
-    assert "Top Findings (Checklist)" in html
-    assert "CL-001 scored 27.00" in html
-    assert "report.md" in html
-
-
-@pytest.mark.asyncio
-async def test_upload_results_renders_structured_synthesis_tables(tmp_path):
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "report.md").write_text("# Report\n\nContent.", encoding="utf-8")
-    (report_dir / "workflow-summary.json").write_text(
-        """
-        {
-          "overall_score": 40.0,
-          "repository": "demo-repo",
-          "synthesis": {
-            "status": "complete",
-            "gaps": [
-              {"check_id": "CL-001", "severity": "high", "finding": "Missing auth guard"}
-            ],
-            "aligned_practices": [
-              {"check_id": "CL-020", "severity": "low", "finding": "Health endpoint documented"}
-            ]
-          }
-        }
-        """.strip(),
-        encoding="utf-8",
-    )
-
-    client = _FakeClient()
-    publisher = ConfluencePublisher(client)
-
-    await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=True,
-    )
-
-    body_path = client.update_page_calls[0]["body_file"]
-    assert isinstance(body_path, Path)
-    html = body_path.read_text(encoding="utf-8")
-    assert "Synthesis Critique" in html
-    assert "<th>Check</th><th>Severity</th><th>Finding</th>" in html
-    assert "CL-001" in html
-    assert "Missing auth guard" in html
-    assert "Health endpoint documented" in html
-    assert "{&#x27;check_id&#x27;" not in html
-
-
-@pytest.mark.asyncio
-async def test_upload_results_renders_summary_from_audit_checklist_json(tmp_path):
-    """TSK-182: Verify summary section is rendered from AuditChecklist JSON."""
-    import json
-
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "report.md").write_text("# Report\n\nContent.", encoding="utf-8")
-
-    # Create a minimal AuditChecklist JSON
-    checklist_data = {
-        "checklist_version": "1.0.0",
-        "generated_at": "2026-02-04T10:00:00",
-        "template_name": "VDS Checklist",
-        "template_version": "1.0",
-        "template_hash": "abc123def456",
-        "template_row_count": 3,
-        "repository": "test-repo",
-        "row_llm_mode": "selective",
-        "evidence_hash": "xyz789abc012",
-        "rows": [
-            {
-                "row_id": "SEC-001:row_0",
-                "row_index": 0,
-                "requirement_text": "Security documentation required",
-                "weight_raw": 10.0,
-                "weight_adjusted": 10.0,
-                "status": "PASS",
-                "score_breakdown": {"raw_score": 95.0, "final_score": 95.0},
-                "evidence_refs": [],
-                "reason": "Documentation found",
-                "finding": "SECURITY.md exists",
-                "provenance": {
-                    "row_llm_mode": "deterministic",
-                    "evaluated_at": "2026-02-04T10:00:00",
-                    "template_hash": "abc123",
-                    "evidence_hash": "xyz789",
-                },
-            },
-            {
-                "row_id": "SEC-001:row_1",
-                "row_index": 1,
-                "requirement_text": "API docs required",
-                "weight_raw": 10.0,
-                "weight_adjusted": 10.0,
-                "status": "PARTIAL",
-                "score_breakdown": {"raw_score": 60.0, "final_score": 60.0},
-                "evidence_refs": [],
-                "reason": "Partial documentation",
-                "finding": "API docs incomplete",
-                "provenance": {
-                    "row_llm_mode": "selective",
-                    "model": "claude-sonnet-4-20250514",
-                    "evaluated_at": "2026-02-04T10:00:00",
-                    "template_hash": "abc123",
-                    "evidence_hash": "xyz789",
-                },
-            },
-            {
-                "row_id": "SEC-001:row_2",
-                "row_index": 2,
-                "requirement_text": "Threat model required",
-                "weight_raw": 10.0,
-                "weight_adjusted": 10.0,
-                "status": "FAIL",
-                "severity": "high",
-                "score_breakdown": {"raw_score": 20.0, "final_score": 20.0},
-                "evidence_refs": [],
-                "reason": "No threat model found",
-                "finding": "Missing threat model",
-                "provenance": {
-                    "row_llm_mode": "selective",
-                    "model": "claude-sonnet-4-20250514",
-                    "evaluated_at": "2026-02-04T10:00:00",
-                    "template_hash": "abc123",
-                    "evidence_hash": "xyz789",
-                },
-            },
-        ],
-    }
-    (report_dir / "audit-checklist.json").write_text(json.dumps(checklist_data), encoding="utf-8")
-
-    client = _FakeClient()
-    publisher = ConfluencePublisher(client)
-
-    await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=True,
-    )
-
-    assert len(client.update_page_calls) == 1
-    body_path = client.update_page_calls[0]["body_file"]
-    assert isinstance(body_path, Path)
-    html = body_path.read_text(encoding="utf-8")
-
-    # Verify summary section
-    assert "Audit Checklist Summary" in html
-    assert "Overall Score" in html
-    assert "Maturity Level" in html
-    assert "Total Checks" in html
-    assert "Pass" in html
-    assert "Partial" in html
-    assert "Fail" in html
-
-
-@pytest.mark.asyncio
-async def test_upload_results_renders_provenance_from_audit_checklist_json(tmp_path):
-    """TSK-182: Verify provenance block is rendered from AuditChecklist JSON."""
-    import json
-
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "report.md").write_text("# Report\n\nContent.", encoding="utf-8")
-
-    # Create a minimal AuditChecklist JSON with provenance info
-    checklist_data = {
-        "checklist_version": "1.0.0",
-        "generated_at": "2026-02-04T10:00:00",
-        "template_name": "VDS Checklist",
-        "template_version": "2.1",
-        "template_hash": "abc123def456",
-        "template_row_count": 1,
-        "repository": "test-repo",
-        "row_llm_mode": "selective",
-        "evidence_hash": "xyz789abc012",
-        "rows": [
-            {
-                "row_id": "SEC-001:row_0",
-                "row_index": 0,
-                "requirement_text": "Test requirement",
-                "weight_raw": 10.0,
-                "weight_adjusted": 10.0,
-                "status": "PASS",
-                "score_breakdown": {"raw_score": 95.0, "final_score": 95.0},
-                "evidence_refs": [],
-                "reason": "OK",
-                "finding": "Found",
-                "provenance": {
-                    "row_llm_mode": "selective",
-                    "model": "claude-sonnet-4-20250514",
-                    "evaluated_at": "2026-02-04T10:00:00",
-                    "template_hash": "abc123",
-                    "evidence_hash": "xyz789",
-                },
-            },
-        ],
-    }
-    (report_dir / "audit-checklist.json").write_text(json.dumps(checklist_data), encoding="utf-8")
-
-    client = _FakeClient()
-    publisher = ConfluencePublisher(client)
-
-    await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=True,
-        thread_id="thread-abc-123",
-    )
-
-    assert len(client.update_page_calls) == 1
-    body_path = client.update_page_calls[0]["body_file"]
-    assert isinstance(body_path, Path)
-    html = body_path.read_text(encoding="utf-8")
-
-    # Verify provenance block
-    assert "Provenance" in html
-    assert "thread-abc-123" in html
-    assert "abc123def456" in html  # template_hash
-    assert "xyz789abc012" in html  # evidence_hash
-    assert "selective" in html  # row_llm_mode
-    assert "VDS Checklist" in html  # template_name
-    assert "claude-sonnet-4-20250514" in html  # LLM model
-
-
-@pytest.mark.asyncio
-async def test_upload_results_renders_provenance_from_workflow_summary_fallback(tmp_path):
-    import json
-
-    report_dir = tmp_path / "runs" / "phase109-incremental-20260309040500" / "repos" / "test-repo"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "report.md").write_text("# Report\n\nContent.", encoding="utf-8")
-    (report_dir / "workflow-summary.json").write_text(
-        json.dumps(
-            {
-                "summary_score_source": "checklist_artifacts_reconciled",
-                "merge_level": "repo",
-                "source_runs": [
-                    "phase109-baseline-20260308-codex-chatgpt",
-                    "phase109-baseline-20260308-alibaba-anthropic",
-                ],
-            }
-        ),
-        encoding="utf-8",
-    )
-
-    client = _FakeClient()
-    publisher = ConfluencePublisher(client)
-
-    await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=True,
-    )
-
-    body_path = client.update_page_calls[0]["body_file"]
-    assert isinstance(body_path, Path)
-    html = body_path.read_text(encoding="utf-8")
-
-    assert "Provenance" in html
-    assert "phase109-incremental-20260309040500" in html
-    assert "checklist_artifacts_reconciled" in html
-    assert "phase109-baseline-20260308-codex-chatgpt" in html
-    assert "phase109-baseline-20260308-alibaba-anthropic" in html
-
-
-@pytest.mark.asyncio
-async def test_upload_results_renders_top_findings_from_audit_checklist_model(tmp_path):
-    """TSK-182: Verify top findings uses typed AuditChecklist model with status colors."""
-    import json
-
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "report.md").write_text("# Report\n\nContent.", encoding="utf-8")
-
-    checklist_data = {
-        "checklist_version": "1.0.0",
-        "generated_at": "2026-02-04T10:00:00",
-        "template_name": "VDS Checklist",
-        "template_version": "1.0",
-        "template_hash": "abc123def456",
-        "template_row_count": 2,
-        "repository": "test-repo",
-        "row_llm_mode": "selective",
-        "evidence_hash": "xyz789abc012",
-        "rows": [
-            {
-                "row_id": "SEC-001:row_0",
-                "row_index": 0,
-                "check_id": "SEC-001",
-                "requirement_text": "Threat model required",
-                "weight_raw": 10.0,
-                "weight_adjusted": 10.0,
-                "status": "FAIL",
-                "score_breakdown": {"raw_score": 10.0, "final_score": 10.0},
-                "evidence_refs": [],
-                "reason": "No threat model documentation found in repository",
-                "finding": "Missing THREAT_MODEL.md or equivalent documentation",
-                "provenance": {
-                    "row_llm_mode": "deterministic",
-                    "evaluated_at": "2026-02-04T10:00:00",
-                    "template_hash": "abc123",
-                    "evidence_hash": "xyz789",
-                },
-            },
-            {
-                "row_id": "SEC-002:row_1",
-                "row_index": 1,
-                "check_id": "SEC-002",
-                "requirement_text": "API documentation",
-                "weight_raw": 10.0,
-                "weight_adjusted": 10.0,
-                "status": "PARTIAL",
-                "score_breakdown": {"raw_score": 55.0, "final_score": 55.0},
-                "evidence_refs": [],
-                "reason": "OpenAPI spec exists but incomplete",
-                "finding": "API documentation is partially complete",
-                "provenance": {
-                    "row_llm_mode": "selective",
-                    "evaluated_at": "2026-02-04T10:00:00",
-                    "template_hash": "abc123",
-                    "evidence_hash": "xyz789",
-                },
-            },
-        ],
-    }
-    (report_dir / "audit-checklist.json").write_text(json.dumps(checklist_data), encoding="utf-8")
-
-    client = _FakeClient()
-    publisher = ConfluencePublisher(client)
-
-    await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=True,
-    )
-
-    assert len(client.update_page_calls) == 1
-    body_path = client.update_page_calls[0]["body_file"]
-    assert isinstance(body_path, Path)
-    html = body_path.read_text(encoding="utf-8")
-
-    # Verify top findings table uses Vietnamese status and includes key fields
-    assert "Phát hiện nổi bật (Checklist)" in html  # Vietnamese header
-    assert "Trạng thái" in html  # Vietnamese header
-    assert "SEC-001" in html  # Check ID
-    assert "SEC-002" in html
-    assert "Missing THREAT_MODEL.md" in html  # Finding text
-    assert "No threat model documentation" in html  # Reason text
-    # Verify status color coding is applied (background-color style)
-    assert "background-color:" in html
-
-
-# TSK-170B Tests: Publish Mode + Attachments Index
-# ==================================================
-
-
-@pytest.mark.asyncio
-async def test_create_only_mode_fails_when_page_exists(tmp_path):
-    """TSK-170B: Test that create-only mode fails when page already exists."""
-    from vds_audit_orchestrator.publishers.confluence_publisher import PublishMode
-
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    markdown = report_dir / "report.md"
-    markdown.write_text("# Report\n\nContent.", encoding="utf-8")
-
-    client = _FakeClient()
-    publisher = ConfluencePublisher(client)
-
-    with pytest.raises(ValueError, match="already exists"):
-        await publisher.upload_results(
-            report_dir=report_dir,
-            parent_page="parent-1",
-            page_title="Run 1",  # This page exists in _FakeClient
-            include_attachments=False,
-            publish_mode=PublishMode.CREATE_ONLY,
-        )
-
-
-@pytest.mark.asyncio
-async def test_create_only_mode_succeeds_for_new_page(tmp_path):
-    """TSK-170B: Test that create-only mode succeeds when page doesn't exist."""
-    from vds_audit_orchestrator.publishers.confluence_publisher import PublishMode
-
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    markdown = report_dir / "report.md"
-    markdown.write_text("# Report\n\nContent.", encoding="utf-8")
-
-    client = _FakeClient()
-    publisher = ConfluencePublisher(client)
-
-    result = await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="New Run",  # This page doesn't exist
-        include_attachments=False,
-        publish_mode=PublishMode.CREATE_ONLY,
-    )
-
-    assert result.page_id == "new-page-1"
-    run_page_creates = [call for call in client.create_page_calls if call.get("title") == "New Run"]
-    assert len(run_page_creates) == 1
-
-
-@pytest.mark.asyncio
-async def test_update_mode_updates_existing_page(tmp_path):
-    """TSK-170B: Test that update mode updates existing pages."""
-    from vds_audit_orchestrator.publishers.confluence_publisher import PublishMode
-
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    markdown = report_dir / "report.md"
-    markdown.write_text("# Report\n\nContent.", encoding="utf-8")
-
-    client = _FakeClient()
-    publisher = ConfluencePublisher(client)
-
-    result = await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",  # This page exists
-        include_attachments=False,
-        publish_mode=PublishMode.UPDATE,
-    )
-
-    assert result.page_id == "run-1"
-    assert len(client.update_page_calls) == 1
-    run_page_creates = [call for call in client.create_page_calls if call.get("title") == "Run 1"]
-    assert len(run_page_creates) == 0
-
-
-@pytest.mark.asyncio
-async def test_attachments_index_returned(tmp_path):
-    """TSK-170B: Test that attachments_index is populated in result."""
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    markdown = report_dir / "report.md"
-    markdown.write_text("# Report\n\nContent.", encoding="utf-8")
-    (report_dir / "audit-checklist.xlsx").write_bytes(b"checklist")
-    (report_dir / "audit-checklist.json").write_text("{}", encoding="utf-8")
-
-    client = _FakeClient()
-    publisher = ConfluencePublisher(client)
-
-    result = await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="New Run",
-        include_attachments=True,
-        include_attachments_index=False,  # Don't add to page, but still track
-    )
-
-    # Attachments index should be populated
-    assert len(result.attachments_index) == 2
-    names = {att["name"] for att in result.attachments_index}
-    assert "audit-checklist.xlsx" in names
-    assert "audit-checklist.json" in names
-
-
-def test_render_attachments_index_html():
-    """TSK-170B: Test attachments index HTML rendering."""
-    client = _FakeClient()
-    publisher = ConfluencePublisher(client)
-
-    attachments_index = [
-        {"name": "audit-checklist.xlsx", "id": "att-1"},
-        {"name": "report.json", "id": "att-2"},
-    ]
-
-    html = publisher._render_attachments_index_html(attachments_index)
-
-    assert "📎 Attachments Index" in html
-    assert "audit-checklist.xlsx" in html
-    assert "report.json" in html
-    assert "Excel Spreadsheet" in html
-    assert "JSON Data" in html
-    assert "ri:attachment" in html  # Confluence attachment link macro
-
-
-def test_render_attachments_index_empty():
-    """TSK-170B: Test that empty attachments returns empty string."""
-    client = _FakeClient()
-    publisher = ConfluencePublisher(client)
-
-    html = publisher._render_attachments_index_html([])
-
-    assert html == ""
-
-
-def test_publish_mode_enum_values():
-    """TSK-170B: Test PublishMode enum values."""
-    from vds_audit_orchestrator.publishers.confluence_publisher import PublishMode
-
-    assert PublishMode.UPDATE.value == "update"
-    assert PublishMode.CREATE_ONLY.value == "create-only"
-
-    # Test case-insensitive parsing
-    assert PublishMode("update") == PublishMode.UPDATE
-    assert PublishMode("create-only") == PublishMode.CREATE_ONLY
-
-
-@pytest.mark.asyncio
-async def test_publish_project_aggregate_updates_analysis_root_when_titles_collide(tmp_path, monkeypatch):
-    report_dir = tmp_path / "aggregate"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "project-readiness.json").write_text(
-        json.dumps(
-            {
-                "project_name": "project-1",
-                "executive_summary": {
-                    "readiness_score_pct": 85.0,
-                    "classification": "in_progress",
-                    "confidence": "HIGH",
-                    "confidence_pct": 90.0,
-                    "general_assessment": "ready",
-                },
-            }
-        ),
-        encoding="utf-8",
-    )
-
-    from vds_audit_orchestrator.publishers import project_aggregate_renderer as _renderer_mod
-
-    monkeypatch.setattr(_renderer_mod.ProjectAggregateRenderer, "render_page", lambda self, report: "<p>aggregate</p>")
-
-    client = _FakeClient()
-    client.pages["analysis-root-1"] = {
-        "id": "analysis-root-1",
-        "title": "Project Analysis - project-1",
-        "parent_id": "parent-1",
-        "space_key": "VDS",
-    }
-    publisher = ConfluencePublisher(client)
-    publisher.validate_storage_format = lambda html: True  # type: ignore[assignment]
-
-    result = await publisher.publish_project_aggregate(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Project Analysis - project-1",
-        include_attachments=False,
-        project_storage_key="project-1",
-    )
-
-    assert result.page_id == "analysis-root-1"
-    assert result.reused_existing_page is True
-    assert len(client.update_page_calls) == 1
-    assert client.update_page_calls[0]["page_id"] == "analysis-root-1"
-    assert [call["title"] for call in client.create_page_calls] == []
-
-
-@pytest.mark.asyncio
-async def test_publish_project_aggregate_creates_child_when_missing(tmp_path, monkeypatch):
-    report_dir = tmp_path / "aggregate"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "project-readiness.json").write_text(
-        json.dumps(
-            {
-                "project_name": "project-1",
-                "executive_summary": {
-                    "readiness_score_pct": 85.0,
-                    "classification": "in_progress",
-                    "confidence": "HIGH",
-                    "confidence_pct": 90.0,
-                    "general_assessment": "ready",
-                },
-            }
-        ),
-        encoding="utf-8",
-    )
-
-    from vds_audit_orchestrator.publishers import project_aggregate_renderer as _renderer_mod
-
-    monkeypatch.setattr(_renderer_mod.ProjectAggregateRenderer, "render_page", lambda self, report: "<p>aggregate</p>")
-
-    client = _FakeClient()
-    publisher = ConfluencePublisher(client)
-    publisher.validate_storage_format = lambda html: True  # type: ignore[assignment]
-
-    result = await publisher.publish_project_aggregate(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Project Aggregate Report",
-        include_attachments=False,
-        project_storage_key="project-1",
-    )
-
-    assert result.page_id.startswith("new-page-")
-    assert result.reused_existing_page is False
-    assert len(client.update_page_calls) == 0
-    created_titles = [call["title"] for call in client.create_page_calls]
-    assert created_titles == ["Project Analysis - project-1", "Project Aggregate Report"]
-
-
-@pytest.mark.asyncio
-async def test_upload_results_incremental_mode_updates_changed_attachments_only(tmp_path):
-    from vds_audit_orchestrator.publishers.confluence_publisher import UpdateMode
-
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "report.md").write_text("# Report\n\nContent.", encoding="utf-8")
-    (report_dir / "audit-checklist.json").write_text(
-        json.dumps(
-            {
-                "checklist_version": "1.0.0",
-                "generated_at": "2026-03-11T00:00:00Z",
-                "template_name": "VDS Checklist",
-                "template_version": "1.0",
-                "template_hash": "th",
-                "template_row_count": 1,
-                "repository": "test-repo",
-                "row_llm_mode": "selective",
-                "evidence_hash": "eh",
-                "rows": [
-                    {
-                        "row_id": "CL-001:row_0",
-                        "row_index": 0,
-                        "check_id": "CL-001",
-                        "requirement_text": "Test requirement",
-                        "weight_raw": 10.0,
-                        "weight_adjusted": 10.0,
-                        "status": "PASS",
-                        "score_breakdown": {"raw_score": 95.0, "final_score": 95.0},
-                        "evidence_refs": [],
-                        "reason": "OK",
-                        "finding": "Found",
-                        "provenance": {
-                            "row_llm_mode": "selective",
-                            "evaluated_at": "2026-03-11T00:00:00Z",
-                            "template_hash": "th",
-                            "evidence_hash": "eh",
-                        },
-                    }
-                ],
-            }
-        ),
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.xlsx").write_bytes(b"xlsx-content")
-    (report_dir / "workflow-summary.json").write_text(
-        '{"overall_score": 88.0, "agent_results":[{"agent":"SecurityAgent","findings":[{"type":"security","description":"X","location":"Y"}]}]}',
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.meta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","row_count":10}',
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.delta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","rows_changed":2,"rows_unchanged":8,"changed_attachments":["audit-checklist.json"]}',
-        encoding="utf-8",
-    )
-
-    client = _FakeClient()
-    client.attachments = [
-        {"id": "att-json", "title": "audit-checklist.json"},
-        {"id": "att-xlsx", "title": "audit-checklist.xlsx"},
-    ]
-    publisher = ConfluencePublisher(client)
-
-    result = await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=True,
-        update_mode=UpdateMode.INCREMENTAL,
-    )
-
-    assert result.update_mode == "incremental"
-    assert result.effective_update_mode == "incremental"
-    assert result.fallback_reason is None
-    assert result.counters["rows_changed"] == 2
-    assert result.counters["rows_unchanged"] == 8
-    assert result.counters["attachments_updated"] == 1
-    assert result.counters["attachments_skipped"] >= 1
-    assert len(client.update_attachment_calls) == 1
-    assert client.update_attachment_calls[0]["file_path"].name == "audit-checklist.json"
-
-
-@pytest.mark.asyncio
-async def test_upload_results_incremental_falls_back_when_artifacts_missing(tmp_path):
-    from vds_audit_orchestrator.publishers.confluence_publisher import UpdateMode
-
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "report.md").write_text("# Report\n\nContent.", encoding="utf-8")
-
-    client = _FakeClient()
-    publisher = ConfluencePublisher(client)
-
-    result = await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=False,
-        update_mode=UpdateMode.INCREMENTAL,
-    )
-
-    assert result.update_mode == "incremental"
-    assert result.effective_update_mode == "full"
-    assert result.fallback_reason == "incremental_missing_meta_or_delta"
-
-
-@pytest.mark.asyncio
-async def test_upload_results_incremental_falls_back_when_page_not_patchable(tmp_path):
-    from vds_audit_orchestrator.publishers.confluence_publisher import UpdateMode
-
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "report.md").write_text("# Report\n\nContent.", encoding="utf-8")
-    (report_dir / "audit-checklist.meta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","row_count":10}',
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.delta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","rows_changed":1,"rows_unchanged":9}',
-        encoding="utf-8",
-    )
-
-    client = _FakeClient()
-    client.current_body = "<p>legacy page without markers</p>"
-    publisher = ConfluencePublisher(client)
-
-    result = await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=False,
-        update_mode=UpdateMode.INCREMENTAL,
-    )
-
-    assert result.effective_update_mode == "full"
-    assert result.fallback_reason == "incremental_unpatchable_content"
-
-
-@pytest.mark.asyncio
-async def test_upload_results_incremental_patches_unwrapped_live_sections(tmp_path):
-    from vds_audit_orchestrator.publishers.confluence_publisher import UpdateMode
-
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "report.md").write_text("# Report\n\nContent.", encoding="utf-8")
-    (report_dir / "audit-checklist.json").write_text(
-        json.dumps(
-            {
-                "checklist_version": "1.0.0",
-                "generated_at": "2026-03-11T00:00:00Z",
-                "template_name": "VDS Checklist",
-                "template_version": "1.0",
-                "template_hash": "th",
-                "template_row_count": 1,
-                "repository": "test-repo",
-                "row_llm_mode": "selective",
-                "evidence_hash": "eh",
-                "rows": [
-                    {
-                        "row_id": "CL-001:row_0",
-                        "row_index": 0,
-                        "check_id": "CL-001",
-                        "requirement_text": "Test requirement",
-                        "weight_raw": 10.0,
-                        "weight_adjusted": 10.0,
-                        "status": "PASS",
-                        "score_breakdown": {"raw_score": 95.0, "final_score": 95.0},
-                        "evidence_refs": [],
-                        "reason": "OK",
-                        "finding": "Found",
-                        "provenance": {
-                            "row_llm_mode": "selective",
-                            "evaluated_at": "2026-03-11T00:00:00Z",
-                            "template_hash": "th",
-                            "evidence_hash": "eh",
-                        },
-                    }
-                ],
-            }
-        ),
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.xlsx").write_bytes(b"xlsx-content")
-    (report_dir / "workflow-summary.json").write_text('{"overall_score": 88.0}', encoding="utf-8")
-    (report_dir / "audit-checklist.meta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","row_count":1}',
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.delta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","rows_changed":1,"rows_unchanged":0,"changed_attachments":["audit-checklist.json"]}',
-        encoding="utf-8",
-    )
-
-    client = _FakeClient()
-    client.current_body = (
-        "<h2>Audit Checklist Summary</h2><p>old summary</p>"
-        "<h2>Top Findings (Checklist) / Phát hiện nổi bật (Checklist)</h2><p>old findings</p>"
-        "<h2>Checklist Tổng hợp</h2><p>old checklist core</p>"
-        '<ac:structured-macro ac:name="expand" ac:schema-version="1">'
-        '<ac:parameter ac:name="title">Chi tiết lý do và minh chứng</ac:parameter>'
-        "<ac:rich-text-body><p>old details</p></ac:rich-text-body></ac:structured-macro>"
-        "<h2>Provenance</h2><p>old provenance</p>"
-    )
-    publisher = ConfluencePublisher(client)
-
-    result = await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=False,
-        update_mode=UpdateMode.INCREMENTAL,
-    )
-
-    assert result.effective_update_mode == "incremental"
-    assert result.fallback_reason is None
-    assert "<!-- VDS:SECTION:summary:START -->" in client.current_body
-    assert "<!-- VDS:SECTION:checklist_core:START -->" in client.current_body
-    assert "old summary" not in client.current_body
-    assert "old checklist core" not in client.current_body
-
-
-@pytest.mark.asyncio
-async def test_upload_results_incremental_preserves_visible_checklist_details_sections(tmp_path):
-    from vds_audit_orchestrator.publishers.confluence_publisher import UpdateMode
-
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    markdown_path = report_dir / "report.md"
-    markdown_path.write_text("# Report\n\nContent.", encoding="utf-8")
-    (report_dir / "audit-checklist.json").write_text(
-        json.dumps(
-            {
-                "checklist_version": "1.0.0",
-                "generated_at": "2026-03-11T00:00:00Z",
-                "template_name": "VDS Checklist",
-                "template_version": "1.0",
-                "template_hash": "th",
-                "template_row_count": 1,
-                "repository": "test-repo",
-                "row_llm_mode": "selective",
-                "evidence_hash": "eh",
-                "rows": [
-                    {
-                        "row_id": "CL-001:row_0",
-                        "row_index": 0,
-                        "check_id": "CL-001",
-                        "requirement_text": "Test requirement",
-                        "weight_raw": 10.0,
-                        "weight_adjusted": 10.0,
-                        "status": "PASS",
-                        "score_breakdown": {"raw_score": 95.0, "final_score": 95.0},
-                        "evidence_refs": [{"ref_type": "file_path", "ref_value": "src/main.ts"}],
-                        "reason": "OK",
-                        "finding": "Found",
-                        "provenance": {
-                            "row_llm_mode": "selective",
-                            "evaluated_at": "2026-03-11T00:00:00Z",
-                            "template_hash": "th",
-                            "evidence_hash": "eh",
-                        },
-                    }
-                ],
-            }
-        ),
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.xlsx").write_bytes(b"xlsx-content")
-    (report_dir / "workflow-summary.json").write_text('{"overall_score": 88.0}', encoding="utf-8")
-    (report_dir / "audit-checklist.meta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","row_count":1}',
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.delta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","rows_changed":1,"rows_unchanged":0,"changed_attachments":["audit-checklist.json"]}',
-        encoding="utf-8",
-    )
-
-    client = _FakeClient()
-    client.current_body = (
-        "<h2>Audit Checklist Summary</h2><p>old summary</p>"
-        "<h2>Top Findings (Checklist) / Phát hiện nổi bật (Checklist)</h2><p>old findings</p>"
-        "<h2>Checklist Tổng hợp</h2><p>old checklist core</p>"
-        "<h2>Chi tiết lý do và minh chứng</h2><table><tbody><tr><td>old details</td></tr></tbody></table>"
-        "<h2>Provenance</h2><p>old provenance</p>"
-    )
-    publisher = ConfluencePublisher(client)
-
-    result = await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=False,
-        update_mode=UpdateMode.INCREMENTAL,
-    )
-
-    assert result.effective_update_mode == "incremental"
-    assert result.fallback_reason is None
-    assert "<h2>Chi tiết lý do và minh chứng</h2>" in client.current_body
-    assert "<th>Phát hiện</th>" in client.current_body
-    assert "<th>Minh chứng</th>" in client.current_body
-    assert "old details" not in client.current_body
-    assert "<!-- VDS:SECTION:checklist_details:START -->" in client.current_body
-    storage_html = markdown_path.with_suffix(".storage.html").read_text(encoding="utf-8")
-    assert "<h2>Chi tiết lý do và minh chứng</h2>" in storage_html
-    assert 'ac:name="expand"' not in storage_html
-
-
-@pytest.mark.asyncio
-async def test_upload_results_incremental_reinserts_missing_checklist_details_section(tmp_path):
-    from vds_audit_orchestrator.publishers.confluence_publisher import UpdateMode
-
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    markdown_path = report_dir / "report.md"
-    markdown_path.write_text("# Report\n\nContent.", encoding="utf-8")
-    (report_dir / "audit-checklist.json").write_text(
-        json.dumps(
-            {
-                "checklist_version": "1.0.0",
-                "generated_at": "2026-03-11T00:00:00Z",
-                "template_name": "VDS Checklist",
-                "template_version": "1.0",
-                "template_hash": "th",
-                "template_row_count": 1,
-                "repository": "test-repo",
-                "row_llm_mode": "selective",
-                "evidence_hash": "eh",
-                "rows": [
-                    {
-                        "row_id": "CL-001:row_0",
-                        "row_index": 0,
-                        "check_id": "CL-001",
-                        "requirement_text": "Test requirement",
-                        "weight_raw": 10.0,
-                        "weight_adjusted": 10.0,
-                        "status": "PASS",
-                        "score_breakdown": {"raw_score": 95.0, "final_score": 95.0},
-                        "evidence_refs": [{"ref_type": "file_path", "ref_value": "src/main.ts"}],
-                        "reason": "OK",
-                        "finding": "Found",
-                        "provenance": {
-                            "row_llm_mode": "selective",
-                            "evaluated_at": "2026-03-11T00:00:00Z",
-                            "template_hash": "th",
-                            "evidence_hash": "eh",
-                        },
-                    }
-                ],
-            }
-        ),
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.xlsx").write_bytes(b"xlsx-content")
-    (report_dir / "workflow-summary.json").write_text('{"overall_score": 88.0}', encoding="utf-8")
-    (report_dir / "audit-checklist.meta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","row_count":1}',
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.delta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","rows_changed":1,"rows_unchanged":0,"changed_attachments":["audit-checklist.json"]}',
-        encoding="utf-8",
-    )
-
-    client = _FakeClient()
-    client.current_body = (
-        "<h2>Audit Checklist Summary</h2><p>old summary</p>"
-        "<h2>Top Findings (Checklist) / Phát hiện nổi bật (Checklist)</h2><p>old findings</p>"
-        "<h2>Checklist Tổng hợp</h2><p>old checklist core</p>"
-    )
-    publisher = ConfluencePublisher(client)
-
-    result = await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=False,
-        update_mode=UpdateMode.INCREMENTAL,
-    )
-
-    assert result.effective_update_mode == "incremental"
-    assert result.fallback_reason is None
-    assert "<!-- VDS:SECTION:checklist_core:START -->" in client.current_body
-    assert "<!-- VDS:SECTION:checklist_details:START -->" in client.current_body
-    assert "<h2>Chi tiết lý do và minh chứng</h2>" in client.current_body
-    assert "<th>Phát hiện</th>" in client.current_body
-    assert "<th>Minh chứng</th>" in client.current_body
-    assert "<h2>Checklist Tổng hợp</h2>" in markdown_path.with_suffix(".storage.html").read_text(encoding="utf-8")
-
-
-@pytest.mark.asyncio
-async def test_upload_results_incremental_preserves_markdown_between_details_and_provenance(tmp_path):
-    from vds_audit_orchestrator.publishers.confluence_publisher import UpdateMode
-
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    markdown_path = report_dir / "report.md"
-    markdown_path.write_text("# Repo Report\n\nUpdated markdown body.", encoding="utf-8")
-    (report_dir / "audit-checklist.json").write_text(
-        json.dumps(
-            {
-                "checklist_version": "1.0.0",
-                "generated_at": "2026-03-11T00:00:00Z",
-                "template_name": "VDS Checklist",
-                "template_version": "1.0",
-                "template_hash": "th",
-                "template_row_count": 1,
-                "repository": "test-repo",
-                "row_llm_mode": "selective",
-                "evidence_hash": "eh",
-                "rows": [
-                    {
-                        "row_id": "CL-001:row_0",
-                        "row_index": 0,
-                        "check_id": "CL-001",
-                        "requirement_text": "Test requirement",
-                        "weight_raw": 10.0,
-                        "weight_adjusted": 10.0,
-                        "status": "PASS",
-                        "score_breakdown": {"raw_score": 95.0, "final_score": 95.0},
-                        "evidence_refs": [{"ref_type": "file_path", "ref_value": "src/main.ts"}],
-                        "reason": "OK",
-                        "finding": "Found",
-                        "provenance": {
-                            "row_llm_mode": "selective",
-                            "evaluated_at": "2026-03-11T00:00:00Z",
-                            "template_hash": "th",
-                            "evidence_hash": "eh",
-                        },
-                    }
-                ],
-            }
-        ),
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.xlsx").write_bytes(b"xlsx-content")
-    (report_dir / "workflow-summary.json").write_text('{"overall_score": 88.0}', encoding="utf-8")
-    (report_dir / "audit-checklist.meta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","row_count":1}',
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.delta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","rows_changed":1,"rows_unchanged":0,"changed_attachments":["audit-checklist.json"]}',
-        encoding="utf-8",
-    )
-
-    client = _FakeClient()
-    client.current_body = (
-        "<h2>Audit Checklist Summary</h2><p>old summary</p>"
-        "<h2>Top Findings (Checklist) / Phát hiện nổi bật (Checklist)</h2><p>old findings</p>"
-        "<h2>Checklist Tổng hợp</h2><p>old checklist core</p>"
-        "<h2>Chi tiết lý do và minh chứng</h2><table><tbody><tr><td>old details</td></tr></tbody></table>"
-        "<h1>Repo Report</h1><p>keep this markdown section</p>"
-        "<h2>Provenance</h2><p>old provenance</p>"
-    )
-    publisher = ConfluencePublisher(client)
-
-    result = await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=False,
-        update_mode=UpdateMode.INCREMENTAL,
-    )
-
-    assert result.effective_update_mode == "incremental"
-    assert result.fallback_reason is None
-    assert "<h1>Repo Report</h1><p>keep this markdown section</p>" in client.current_body
-    assert "<h2>Chi tiết lý do và minh chứng</h2>" in client.current_body
-    assert "old details" not in client.current_body
-
-
-@pytest.mark.asyncio
-async def test_upload_results_incremental_handles_literal_unicode_escape_sequences(tmp_path):
-    from vds_audit_orchestrator.publishers.confluence_publisher import UpdateMode
-
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "report.md").write_text("# Repo Report\n\nContent.", encoding="utf-8")
-    (report_dir / "audit-checklist.json").write_text(
-        json.dumps(
-            {
-                "checklist_version": "1.0.0",
-                "generated_at": "2026-03-11T00:00:00Z",
-                "template_name": "VDS Checklist",
-                "template_version": "1.0",
-                "template_hash": "th",
-                "template_row_count": 1,
-                "repository": "test-repo",
-                "row_llm_mode": "selective",
-                "evidence_hash": "eh",
-                "rows": [
-                    {
-                        "row_id": "CL-001:row_0",
-                        "row_index": 0,
-                        "check_id": "CL-001",
-                        "requirement_text": "Test requirement",
-                        "weight_raw": 10.0,
-                        "weight_adjusted": 10.0,
-                        "status": "FAIL",
-                        "score_breakdown": {"raw_score": 40.0, "final_score": 40.0},
-                        "evidence_refs": [
-                            {
-                                "ref_type": "doc",
-                                "ref_value": "chunk:abc",
-                                "excerpt": '"C\\\\u00f3 grounding"',
-                            }
-                        ],
-                        "reason": "Timeout fallback excerpt kept literal escape text.",
-                        "finding": "Found",
-                        "provenance": {
-                            "row_llm_mode": "selective",
-                            "evaluated_at": "2026-03-11T00:00:00Z",
-                            "template_hash": "th",
-                            "evidence_hash": "eh",
-                        },
-                    }
-                ],
-            }
-        ),
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.xlsx").write_bytes(b"xlsx-content")
-    (report_dir / "workflow-summary.json").write_text('{"overall_score": 40.0}', encoding="utf-8")
-    (report_dir / "audit-checklist.meta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","row_count":1}',
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.delta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","rows_changed":1,"rows_unchanged":0,"changed_attachments":["audit-checklist.json"]}',
-        encoding="utf-8",
-    )
-
-    client = _FakeClient()
-    client.current_body = (
-        "<h2>Audit Checklist Summary</h2><p>old summary</p>"
-        "<h2>Top Findings (Checklist) / Phát hiện nổi bật (Checklist)</h2><p>old findings</p>"
-        "<h2>Checklist Tổng hợp</h2><p>old checklist core</p>"
-        "<h2>Chi tiết lý do và minh chứng</h2><table><tbody><tr><td>old details</td></tr></tbody></table>"
-        "<h2>Provenance</h2><p>old provenance</p>"
-    )
-    publisher = ConfluencePublisher(client)
-
-    result = await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=False,
-        update_mode=UpdateMode.INCREMENTAL,
-    )
-
-    assert result.effective_update_mode == "incremental"
-    assert result.fallback_reason is None
-    assert "\\u00f3" in client.current_body
-
-
-@pytest.mark.asyncio
-async def test_upload_results_incremental_falls_back_when_existing_checklist_sections_have_no_new_checklist(tmp_path):
-    from vds_audit_orchestrator.publishers.confluence_publisher import UpdateMode
-
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "report.md").write_text("# Report\n\nContent.", encoding="utf-8")
-    (report_dir / "audit-checklist.meta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","row_count":10}',
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.delta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","rows_changed":1,"rows_unchanged":9}',
-        encoding="utf-8",
-    )
-
-    client = _FakeClient()
-    client.current_body = (
-        "<!-- VDS:SECTION:summary:START --><p>old summary</p><!-- VDS:SECTION:summary:END -->"
-        "<!-- VDS:SECTION:checklist_core:START --><p>old checklist core</p><!-- VDS:SECTION:checklist_core:END -->"
-        "<!-- VDS:SECTION:checklist_details:START --><p>old checklist details</p><!-- VDS:SECTION:checklist_details:END -->"
-    )
-    publisher = ConfluencePublisher(client)
-
-    result = await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=False,
-        update_mode=UpdateMode.INCREMENTAL,
-    )
-
-    assert result.effective_update_mode == "full"
-    assert result.fallback_reason == "incremental_missing_checklist_for_existing_sections"
-
-
-@pytest.mark.asyncio
-async def test_upload_results_incremental_skips_attachment_when_remote_hash_matches(tmp_path):
-    from vds_audit_orchestrator.publishers.confluence_publisher import UpdateMode
-
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "report.md").write_text("# Report\n\nContent.", encoding="utf-8")
-    payload = json.dumps(
-        {
-            "checklist_version": "1.0.0",
-            "generated_at": "2026-03-11T00:00:00Z",
-            "template_name": "VDS Checklist",
-            "template_version": "1.0",
-            "template_hash": "th",
-            "template_row_count": 0,
-            "repository": "test-repo",
-            "row_llm_mode": "selective",
-            "evidence_hash": "eh",
-            "rows": [],
-        }
-    )
-    (report_dir / "audit-checklist.json").write_text(payload, encoding="utf-8")
-    (report_dir / "workflow-summary.json").write_text('{"overall_score": 85.0}', encoding="utf-8")
-    (report_dir / "audit-checklist.meta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","row_count":10}',
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.delta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","rows_changed":0,"rows_unchanged":10,"changed_attachments":["audit-checklist.json"]}',
-        encoding="utf-8",
-    )
-
-    import hashlib
-
-    local_hash = hashlib.sha256(payload.encode("utf-8")).hexdigest()
-    client = _FakeClient()
-    client.attachments = [
-        {"id": "att-json", "title": "audit-checklist.json", "metadata": {"comment": f"sha256:{local_hash}"}}
-    ]
-    publisher = ConfluencePublisher(client)
-
-    result = await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=True,
-        update_mode=UpdateMode.INCREMENTAL,
-    )
-
-    assert result.effective_update_mode == "incremental"
-    assert result.counters["attachments_updated"] == 0
-    assert result.counters["attachments_skipped"] >= 1
-    assert client.update_attachment_calls == []
-
-
-@pytest.mark.asyncio
-async def test_update_run_page_incremental_retries_version_conflict(tmp_path):
-    class _VersionConflictOnceClient(_FakeClient):
-        def __init__(self) -> None:
-            super().__init__()
-            self._version_number = 5
-            self._conflict_raised = False
-
-        async def get_content_page(self, page_id: str, *, expand: str | None = None) -> dict[str, object]:
-            return {
-                "version": {"number": self._version_number},
-                "space": {"key": "VDS"},
-                "body": {"storage": {"value": self.current_body}},
-            }
-
-        async def update_page(
-            self,
-            page_id: str,
-            *,
-            title: str | None = None,
-            body_file: Path | None = None,
-            version: int | None = None,
-        ) -> dict[str, object]:
-            self.update_page_calls.append(
-                {"page_id": page_id, "title": title, "body_file": body_file, "version": version}
-            )
-            if not self._conflict_raised and body_file and str(body_file).endswith(".incremental.storage.html"):
-                self._conflict_raised = True
-                self._version_number = 6
-                raise DataSourceError(
-                    "Confluence operation failed: update_page",
-                    context={"error": "409 Conflict: version mismatch"},
-                )
-            if body_file and body_file.exists():
-                self.current_body = body_file.read_text(encoding="utf-8")
-            if isinstance(version, int):
-                self._version_number = version
-            return {"id": page_id}
-
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    markdown = report_dir / "report.md"
-    markdown.write_text("# Report\n\nContent.", encoding="utf-8")
-    (report_dir / "workflow-summary.json").write_text(
-        '{"agent_results":[{"agent":"SecurityAgent","findings":[{"type":"security","description":"X","location":"Y"}]}]}',
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.json").write_text(
-        json.dumps(
-            {
-                "checklist_version": "1.0.0",
-                "generated_at": "2026-03-11T00:00:00Z",
-                "template_name": "VDS Checklist",
-                "template_version": "1.0",
-                "template_hash": "th",
-                "template_row_count": 0,
-                "repository": "test-repo",
-                "row_llm_mode": "selective",
-                "evidence_hash": "eh",
-                "rows": [],
-            }
-        ),
-        encoding="utf-8",
-    )
-
-    client = _VersionConflictOnceClient()
-    publisher = ConfluencePublisher(client)
-
-    updated, reason = await publisher.update_run_page_incremental(
-        page_id="run-1",
-        title="Run 1",
-        report_dir=report_dir,
-        markdown_path=markdown,
-    )
-
-    assert updated is True
-    assert reason is None
-    assert len(client.update_page_calls) == 2
-    assert client.update_page_calls[0]["version"] == 6
-    assert client.update_page_calls[1]["version"] == 7
-
-
-@pytest.mark.asyncio
-async def test_upload_results_incremental_falls_back_when_version_conflicts_exhausted(tmp_path):
-    from vds_audit_orchestrator.publishers.confluence_publisher import UpdateMode
-
-    class _VersionConflictAlwaysClient(_FakeClient):
-        async def update_page(
-            self,
-            page_id: str,
-            *,
-            title: str | None = None,
-            body_file: Path | None = None,
-            version: int | None = None,
-        ) -> dict[str, object]:
-            self.update_page_calls.append(
-                {"page_id": page_id, "title": title, "body_file": body_file, "version": version}
-            )
-            if body_file and str(body_file).endswith(".incremental.storage.html"):
-                raise DataSourceError(
-                    "Confluence operation failed: update_page",
-                    context={"error": "HTTP 409 conflict on version"},
-                )
-            if body_file and body_file.exists():
-                self.current_body = body_file.read_text(encoding="utf-8")
-            return {"id": page_id}
-
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "report.md").write_text("# Report\n\nContent.", encoding="utf-8")
-    (report_dir / "workflow-summary.json").write_text(
-        '{"agent_results":[{"agent":"SecurityAgent","findings":[{"type":"security","description":"X","location":"Y"}]}]}',
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.json").write_text(
-        json.dumps(
-            {
-                "checklist_version": "1.0.0",
-                "generated_at": "2026-03-11T00:00:00Z",
-                "template_name": "VDS Checklist",
-                "template_version": "1.0",
-                "template_hash": "th",
-                "template_row_count": 0,
-                "repository": "test-repo",
-                "row_llm_mode": "selective",
-                "evidence_hash": "eh",
-                "rows": [],
-            }
-        ),
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.meta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","row_count":10}',
-        encoding="utf-8",
-    )
-    (report_dir / "audit-checklist.delta.json").write_text(
-        '{"template_hash":"th","evidence_hash":"eh","rows_changed":1,"rows_unchanged":9}',
-        encoding="utf-8",
-    )
-
-    client = _VersionConflictAlwaysClient()
-    publisher = ConfluencePublisher(client)
-
-    result = await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=False,
-        update_mode=UpdateMode.INCREMENTAL,
-    )
-
-    assert result.update_mode == "incremental"
-    assert result.effective_update_mode == "full"
-    assert result.fallback_reason == "incremental_version_conflict_retry_exhausted"
-    assert len(client.update_page_calls) == 4
-
-
-@pytest.mark.asyncio
-async def test_attachments_index_preserves_rich_body_content(tmp_path):
-    """Regression: attachments index must not overwrite rich page body (TSK-940.74).
-
-    Before the fix, get_page() was called without expand='body.storage', returning
-    an empty body. The update_page() then overwrote the rich content with just
-    the attachments index table.
-    """
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "report.md").write_text("# Report\n\nContent.", encoding="utf-8")
-    (report_dir / "report.json").write_text("{}", encoding="utf-8")
-
-    rich_body = (
-        "<h1>Score Summary</h1><p>Overall: 85%</p>"
-        "<h2>Priority Actions</h2><ul><li>Fix auth</li></ul>"
-        "<h2>Checklist</h2><table><tr><td>Row 1</td></tr></table>"
-    )
-    client = _FakeClient()
-    client.current_body = rich_body
-    publisher = ConfluencePublisher(client)
-
-    result = await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=True,
-        include_attachments_index=True,
-    )
-
-    assert result.page_id == "run-1"
-    # The update_page call for the main body + the attachments index update = 2 calls
-    # The second call (attachments index) must preserve the rich body
-    if len(client.update_page_calls) >= 2:
-        index_update = client.update_page_calls[-1]
-        body_file = index_update.get("body_file")
-        if isinstance(body_file, Path) and body_file.exists():
-            written_html = body_file.read_text(encoding="utf-8")
-            # Rich body content MUST be preserved
-            assert "Score Summary" in written_html, "Rich body content was overwritten by attachments index"
-            assert "Priority Actions" in written_html, "Priority Actions section was lost"
-            assert "Checklist" in written_html, "Checklist section was lost"
-
-
-@pytest.mark.asyncio
-async def test_attachments_index_skips_overwrite_when_body_empty(tmp_path):
-    """Regression: if get_page returns empty body despite expand, skip the overwrite."""
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "report.md").write_text("# Report\n\nContent.", encoding="utf-8")
-    (report_dir / "report.json").write_text("{}", encoding="utf-8")
-
-    class _EmptyBodyClient(_FakeClient):
-        """Client that returns empty body from get_page regardless of expand."""
-
-        async def get_page(self, page_id: str, *, expand: str | None = None) -> dict[str, object] | None:
-            return {"id": page_id, "body": {"storage": {"value": ""}}, "version": {"number": 5}}
-
-    client = _EmptyBodyClient()
-    publisher = ConfluencePublisher(client)
-
-    result = await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Run 1",
-        include_attachments=True,
-        include_attachments_index=True,
-    )
-
-    assert result.page_id == "run-1"
-    # Main body update happens (1 call), but the attachments index update
-    # should be skipped because get_page returned an empty body.storage.
-    assert len(client.update_page_calls) == 1, (
-        "Expected only 1 update_page call (main body); attachments index should be skipped when body is empty"
-    )
-
-
-# ---------------------------------------------------------------------------
-# G-4: Section append mode (_append_to_section)
-# ---------------------------------------------------------------------------
-
-
-class TestAppendToSection:
-    """G-4: Verify _append_to_section inserts content before the END marker."""
-
-    def _publisher(self) -> ConfluencePublisher:
-        return ConfluencePublisher(_FakeClient())
-
-    def test_append_to_existing_section(self):
-        publisher = self._publisher()
-        body = "<!-- VDS:SECTION:summary:START -->\n<p>existing content</p>\n<!-- VDS:SECTION:summary:END -->"
-        updated, changed = publisher._append_to_section(body, "summary", "<p>new row</p>")
-        assert changed is True
-        assert "<p>existing content</p>" in updated
-        assert "<p>new row</p>" in updated
-        # The new content must appear before the END marker
-        end_pos = updated.index("<!-- VDS:SECTION:summary:END -->")
-        new_pos = updated.index("<p>new row</p>")
-        assert new_pos < end_pos
-        # The existing content must still precede the new content
-        existing_pos = updated.index("<p>existing content</p>")
-        assert existing_pos < new_pos
-
-    def test_append_preserves_start_marker(self):
-        publisher = self._publisher()
-        body = "<!-- VDS:SECTION:top_findings:START -->\n<p>old findings</p>\n<!-- VDS:SECTION:top_findings:END -->"
-        updated, changed = publisher._append_to_section(body, "top_findings", "<tr><td>new</td></tr>")
-        assert changed is True
-        assert "<!-- VDS:SECTION:top_findings:START -->" in updated
-        assert "<!-- VDS:SECTION:top_findings:END -->" in updated
-
-    def test_append_returns_false_when_section_missing(self):
-        publisher = self._publisher()
-        body = "<p>no sections here</p>"
-        updated, changed = publisher._append_to_section(body, "summary", "<p>new</p>")
-        assert changed is False
-        assert updated == body
-
-    def test_append_does_not_affect_other_sections(self):
-        publisher = self._publisher()
-        body = (
-            "<!-- VDS:SECTION:summary:START -->\n<p>summary</p>\n<!-- VDS:SECTION:summary:END -->\n"
-            "<!-- VDS:SECTION:top_findings:START -->\n<p>findings</p>\n<!-- VDS:SECTION:top_findings:END -->"
-        )
-        updated, changed = publisher._append_to_section(body, "summary", "<p>appended</p>")
-        assert changed is True
-        # top_findings should remain untouched
-        assert "<p>findings</p>" in updated
-        assert updated.count("<!-- VDS:SECTION:top_findings:START -->") == 1
-        assert updated.count("<!-- VDS:SECTION:top_findings:END -->") == 1
-
-    def test_append_multiple_times(self):
-        publisher = self._publisher()
-        body = (
-            "<!-- VDS:SECTION:checklist_core:START -->\n<tr><td>row1</td></tr>\n<!-- VDS:SECTION:checklist_core:END -->"
-        )
-        body, ok1 = publisher._append_to_section(body, "checklist_core", "<tr><td>row2</td></tr>")
-        assert ok1 is True
-        body, ok2 = publisher._append_to_section(body, "checklist_core", "<tr><td>row3</td></tr>")
-        assert ok2 is True
-        # All three rows should be present in order
-        assert body.index("row1") < body.index("row2") < body.index("row3")
-        # Still properly enclosed
-        assert "<!-- VDS:SECTION:checklist_core:START -->" in body
-        assert "<!-- VDS:SECTION:checklist_core:END -->" in body
-
-
-# ---------------------------------------------------------------------------
-# G-5: Section read-back (_extract_section_content / read_section)
-# ---------------------------------------------------------------------------
-
-
-class TestExtractSectionContent:
-    """G-5: Verify _extract_section_content extracts inner content between markers."""
-
-    def _publisher(self) -> ConfluencePublisher:
-        return ConfluencePublisher(_FakeClient())
-
-    def test_extract_simple_section(self):
-        publisher = self._publisher()
-        body = "<!-- VDS:SECTION:summary:START -->\n<p>summary content</p>\n<!-- VDS:SECTION:summary:END -->"
-        result = publisher._extract_section_content(body, "summary")
-        assert result is not None
-        assert "<p>summary content</p>" in result
-
-    def test_extract_returns_none_when_missing(self):
-        publisher = self._publisher()
-        body = "<p>no sections</p>"
-        result = publisher._extract_section_content(body, "summary")
-        assert result is None
-
-    def test_extract_specific_section_from_multi_section_body(self):
-        publisher = self._publisher()
-        body = (
-            "<!-- VDS:SECTION:summary:START -->\n<p>summary</p>\n<!-- VDS:SECTION:summary:END -->\n"
-            "<!-- VDS:SECTION:top_findings:START -->\n<p>findings here</p>\n<!-- VDS:SECTION:top_findings:END -->"
-        )
-        result = publisher._extract_section_content(body, "top_findings")
-        assert result is not None
-        assert "<p>findings here</p>" in result
-        assert "<p>summary</p>" not in result
-
-    def test_extract_multiline_content(self):
-        publisher = self._publisher()
-        body = (
-            "<!-- VDS:SECTION:checklist_details:START -->\n"
-            "<table>\n"
-            "<tr><td>row 1</td></tr>\n"
-            "<tr><td>row 2</td></tr>\n"
-            "</table>\n"
-            "<!-- VDS:SECTION:checklist_details:END -->"
-        )
-        result = publisher._extract_section_content(body, "checklist_details")
-        assert result is not None
-        assert "<tr><td>row 1</td></tr>" in result
-        assert "<tr><td>row 2</td></tr>" in result
-        assert "<table>" in result
-
-    def test_extract_empty_section(self):
-        publisher = self._publisher()
-        body = "<!-- VDS:SECTION:summary:START --><!-- VDS:SECTION:summary:END -->"
-        result = publisher._extract_section_content(body, "summary")
-        assert result is not None
-        assert result == ""
-
-
-@pytest.mark.asyncio
-async def test_read_section_fetches_and_extracts():
-    """G-5: read_section fetches page via API and extracts section content."""
-    client = _FakeClient()
-    client.current_body = "<!-- VDS:SECTION:summary:START -->\n<p>remote summary</p>\n<!-- VDS:SECTION:summary:END -->"
-    publisher = ConfluencePublisher(client)
-    result = await publisher.read_section("page-123", "summary")
-    assert result is not None
-    assert "<p>remote summary</p>" in result
-
-
-@pytest.mark.asyncio
-async def test_read_section_returns_none_when_section_absent():
-    """G-5: read_section returns None when section key is not in page body."""
-    client = _FakeClient()
-    client.current_body = "<p>no sections</p>"
-    publisher = ConfluencePublisher(client)
-    result = await publisher.read_section("page-123", "nonexistent")
-    assert result is None
-
-
-@pytest.mark.asyncio
-async def test_read_section_returns_none_when_body_empty():
-    """G-5: read_section returns None when page has empty body."""
-
-    class _EmptyBodyClient(_FakeClient):
-        async def get_content_page(self, page_id: str, *, expand: str | None = None) -> dict[str, object]:
-            return {"version": {"number": 1}, "body": {"storage": {"value": ""}}}
-
-    publisher = ConfluencePublisher(_EmptyBodyClient())
-    result = await publisher.read_section("page-123", "summary")
-    assert result is None
-
-
-# ---------------------------------------------------------------------------
-# FR-172: Degraded-mode skip guards in ConfluencePublisher
-# ---------------------------------------------------------------------------
-
-
-@pytest.mark.asyncio
-async def test_upload_results_skips_when_client_degraded(tmp_path: Path) -> None:
-    """upload_results() returns early with fallback_reason='degraded' when client is degraded."""
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir()
-    (report_dir / "report.md").write_text("# Report", encoding="utf-8")
-
-    client = _FakeClient()
-    client.is_degraded = True
-    publisher = ConfluencePublisher(client)
-
-    result = await publisher.upload_results(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Audit Results - test-repo",
-    )
-
-    assert result.fallback_reason == "degraded"
-    assert result.page_id == ""
-    assert result.page_url is None
-    # No Confluence API calls were made
-    assert client.create_page_calls == []
-    assert client.update_page_calls == []
-
-
-@pytest.mark.asyncio
-async def test_upload_results_proceeds_when_not_degraded(tmp_path: Path) -> None:
-    """upload_results() proceeds normally when client.is_degraded is False."""
-    report_dir = tmp_path / "reports"
-    report_dir.mkdir()
-    (report_dir / "report.md").write_text("# Report", encoding="utf-8")
-
-    client = _FakeClient()
-    # is_degraded is False by default
-    publisher = ConfluencePublisher(client)
-
-    # Should attempt Confluence calls (may raise due to fake client limitations,
-    # but must NOT short-circuit to degraded early return)
-    try:
-        result = await publisher.upload_results(
-            report_dir=report_dir,
-            parent_page="parent-1",
-            page_title="Audit Results - test-repo",
-        )
-        assert result.fallback_reason != "degraded"
-    except Exception:
-        # Any error is fine — the key assertion is that degraded guard was NOT triggered
-        pass
-
-
-@pytest.mark.asyncio
-async def test_publish_project_aggregate_skips_when_client_degraded(tmp_path: Path) -> None:
-    """publish_project_aggregate() returns early with fallback_reason='degraded'."""
-    report_dir = tmp_path / "project-reports"
-    report_dir.mkdir()
-    # No project-readiness.json needed — degraded check fires before file I/O
-
-    client = _FakeClient()
-    client.is_degraded = True
-    publisher = ConfluencePublisher(client)
-
-    result = await publisher.publish_project_aggregate(
-        report_dir=report_dir,
-        parent_page="parent-1",
-        page_title="Project Analysis - test-proj",
-    )
-
-    assert result.fallback_reason == "degraded"
-    assert result.page_id == ""
-    assert result.page_url is None
-    assert client.create_page_calls == []
-    assert client.update_page_calls == []