@produtype/core 0.21.0 → 0.22.1

package/dist/planner/buildPlan.js

@@ -16,9 +16,17 @@ const severityOrder = {
     info: 4,
 };
 const phaseMeta = {
+    /**
+     * The phase is about order, not about severity.
+     *
+     * It was titled "Critical production blockers", and fifty-one of the fifty-nine plans
+     * that had a non-empty one contained no critical finding at all — a heading announcing
+     * critical blockers directly above a report whose own count of critical issues was
+     * zero. The grouping is right; the promise in the words was not.
+     */
     'critical-blockers': {
-        title: 'Critical production blockers',
-        description: 'Fix the items most likely to cause immediate security, auth, or data-loss regressions.',
+        title: 'Security and access, first',
+        description: 'Identity, secrets and anything exposed without a check. These come first because the rest of the plan rests on them — not because each item is critical; every task carries its own severity.',
     },
     'saas-safety-layer': {
         title: 'SaaS safety layer',

package/dist/planner/markdownPlan.js

@@ -33,11 +33,20 @@ function renderTask(task) {
     ].join('\n');
 }
 function renderPhase(phase) {
+    /**
+     * Four bare words in brackets are four facts a reader cannot tell apart.
+     *
+     * `[p1, small, low, safe_template]` was the whole annotation: which of those is the
+     * effort and which the risk is only knowable from the source. They are named now,
+     * which costs a line's width and saves the reader guessing.
+     */
     const tasks = phase.tasks.length > 0
-        ? phase.tasks.map((task) => `- ${task.id}: ${task.title} [${task.priority}, ${task.effort}, ${task.risk}, ${task.automationReadiness}]`).join('\n')
+        ? phase.tasks.map((task) => `- ${task.id}: ${task.title} — priority ${task.priority}, effort ${task.effort}, risk ${task.risk}, automation ${task.automationReadiness}`).join('\n')
         : '- none';
     return [
-        `## ${phase.title}`,
+        // A phase is part of the plan's list of phases, so it sits under it rather than
+        // beside it. Every phase was a sibling of the "Phases" heading that introduced them.
+        `### ${phase.title}`,
         '',
         phase.description,
         '',

package/dist/report/categoryScores.js

@@ -86,7 +86,22 @@ function buildCategoryScores(findings) {
          * critical and nine passing checks is not 90% healthy". The cap keeps that;
          * the proportion does the ranking underneath it.
          */
-        const worstOpen = actionable.reduce((worst, finding) => (SEVERITY_WEIGHT[finding.stakes] > SEVERITY_WEIGHT[worst] ? finding.stakes : worst), 'info');
+        /**
+         * The ceiling follows what the report says is wrong, not what the area is worth.
+         *
+         * These are two different numbers on purpose: `stakes` is what a capability is worth
+         * before confidence is folded in, and `severity` is what the report is willing to
+         * claim about it. Using stakes here capped a category at the critical ceiling while
+         * the row beside it read "0 critical" — a Django project with four of five security
+         * checks verified and one high finding open scored 20 of 100, below an area with one
+         * of three verified.
+         *
+         * The proportion below still uses stakes, which is right: how much of what is at
+         * stake is failing does not change because the report hedged. What changes is the
+         * cap, and a cap that says "nothing looks healthy while something severe is open"
+         * has to mean the severity the reader was shown.
+         */
+        const worstOpen = actionable.reduce((worst, finding) => (SEVERITY_WEIGHT[finding.severity] > SEVERITY_WEIGHT[worst] ? finding.severity : worst), 'info');
         const ceiling = SEVERITY_CEILING[worstOpen];
         return {
             category,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.21.0",
+  "version": "0.22.1",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {