mandrel 1.57.0

package/.agents/scripts/lib/qa/console-allowlist.js

@@ -0,0 +1,151 @@
+/**
+ * console-allowlist.js — deterministic console-message → finding filter.
+ *
+ * Story #3295 (Feature #3289 "Instrumentation, inspection & findings",
+ * Epic #3214). The QA harness captures per-surface console messages via
+ * `list_console_messages` and must turn genuine console errors into
+ * structured findings while suppressing benign, expected noise. The
+ * suppression contract is the `qa.consoleAllowlist` array bound in
+ * `.agentrc.json` (landed by Story #3293): a list of inline patterns that
+ * mark a console message as expected.
+ *
+ * This module is the pure, side-effect-free decision layer. Given a list of
+ * captured console messages and the consumer's `consoleAllowlist`, it returns
+ * one structured finding per non-allowlisted console error and drops every
+ * message matched by an allowlist pattern. Determinism is load-bearing:
+ * re-running the filter over the same captured console with the same allowlist
+ * always yields the same findings in the same order, so the surrounding
+ * harness produces stable, diffable evidence.
+ *
+ * The emitted finding aligns with the `F#` finding shape from Tech Spec #3285
+ * (`{ id, classification, surface, symptom, likelyRootCause, disposition,
+ * acceptance, evidence: { console[], network[] } }`). Finding-shape *schema*
+ * validation (`qa-finding.schema.json`) is a sibling Story; this module only
+ * produces the console-derived subset and leaves richer enrichment
+ * (likely-root-cause heuristics, drafting) to later layers.
+ */
+
+/**
+ * Console message levels that the harness treats as error-grade. Only
+ * messages at one of these levels can become a finding; `log`, `info`,
+ * `debug`, and `warning` are never escalated by this module.
+ *
+ * @type {ReadonlySet<string>}
+ */
+const ERROR_LEVELS = new Set(['error', 'severe']);
+
+/**
+ * Normalise a captured console message into `{ level, text }`. Capture
+ * surfaces (`list_console_messages`, raw CDP, etc.) disagree on field names,
+ * so accept the common spellings and coerce defensively. A message with no
+ * recoverable text normalises to an empty string (which never matches an
+ * allowlist pattern and never reads as an error symptom).
+ *
+ * @param {unknown} message
+ * @returns {{ level: string, text: string }}
+ */
+function normaliseMessage(message) {
+  if (message == null || typeof message !== 'object') {
+    return { level: '', text: typeof message === 'string' ? message : '' };
+  }
+  const record = /** @type {Record<string, unknown>} */ (message);
+  const rawLevel = record.level ?? record.type ?? record.severity ?? '';
+  const rawText = record.text ?? record.message ?? record.value ?? '';
+  return {
+    level: String(rawLevel).toLowerCase(),
+    text: String(rawText),
+  };
+}
+
+/**
+ * Decide whether a console message text is matched by any allowlist pattern.
+ *
+ * Each allowlist entry is matched as a case-sensitive substring against the
+ * message text. Substring (not regex) matching is the deliberate contract:
+ * patterns stay readable in `.agentrc.json`, an operator never has to escape
+ * regex metacharacters, and the decision is trivially deterministic. An empty
+ * or blank pattern is ignored (it would otherwise match everything and
+ * silently swallow every error).
+ *
+ * @param {string} text Normalised console message text.
+ * @param {string[]} allowlist Inline benign-console patterns.
+ * @returns {boolean} `true` when the message is allowlisted (suppress it).
+ */
+export function isAllowlisted(text, allowlist) {
+  if (!Array.isArray(allowlist) || allowlist.length === 0) {
+    return false;
+  }
+  return allowlist.some((pattern) => {
+    if (typeof pattern !== 'string' || pattern.trim() === '') {
+      return false;
+    }
+    return text.includes(pattern);
+  });
+}
+
+/**
+ * Build a structured finding for a single non-allowlisted console error.
+ * The `id` is assigned by the caller (1-based finding index across a surface)
+ * so the surrounding harness controls finding numbering across console and
+ * network evidence.
+ *
+ * @param {{ level: string, text: string }} message Normalised console error.
+ * @param {{ surface?: string, index: number }} ctx
+ * @returns {object} Structured `F#` finding (console-derived subset).
+ */
+function buildFinding(message, ctx) {
+  return {
+    id: `F${ctx.index}`,
+    classification: 'console-error',
+    surface: ctx.surface ?? 'unknown',
+    symptom: message.text,
+    likelyRootCause: null,
+    disposition: 'follow-up',
+    acceptance: null,
+    evidence: {
+      console: [{ level: message.level, text: message.text }],
+      network: [],
+    },
+  };
+}
+
+/**
+ * Filter captured console messages through the `consoleAllowlist` and emit a
+ * structured finding for each non-allowlisted console error.
+ *
+ * Behaviour contract:
+ * - A console **error** (level `error`/`severe`) whose text matches no
+ *   allowlist pattern becomes exactly one finding.
+ * - A console message matched by any allowlist pattern is suppressed — no
+ *   finding — even when it is an error.
+ * - Non-error levels (`log`, `info`, `warning`, …) are never escalated.
+ * - Findings are returned in capture order; ids are assigned `F1`, `F2`, …
+ *   in that order.
+ *
+ * @param {Array<unknown>} messages Captured console messages.
+ * @param {string[]} [allowlist] `qa.consoleAllowlist` patterns.
+ * @param {{ surface?: string }} [opts] Surface label for the finding.
+ * @returns {object[]} Structured findings (possibly empty).
+ */
+export function filterConsoleMessages(messages, allowlist = [], opts = {}) {
+  if (!Array.isArray(messages)) {
+    return [];
+  }
+  const findings = [];
+  for (const raw of messages) {
+    const message = normaliseMessage(raw);
+    if (!ERROR_LEVELS.has(message.level)) {
+      continue;
+    }
+    if (isAllowlisted(message.text, allowlist)) {
+      continue;
+    }
+    findings.push(
+      buildFinding(message, {
+        surface: opts.surface,
+        index: findings.length + 1,
+      }),
+    );
+  }
+  return findings;
+}

package/.agents/scripts/lib/qa/coverage-report.js

@@ -0,0 +1,181 @@
+// .agents/scripts/lib/qa/coverage-report.js
+//
+// Render an AC × test-tier coverage matrix to a human-readable markdown
+// report and persist it under `<tempRoot>/qa/`.
+//
+// The matrix shape is produced by `lib/qa/coverage-verdict.js#acceptanceMatrix`
+// — one row per acceptance criterion, each row carrying the per-tier
+// `coverageVerdict` (`{unit, contract, acceptance}` with `present`/`absent`
+// statuses + notes). This module is the presentation + persistence seam:
+//   - {@link renderCoverageReport}  — pure: matrix → markdown string.
+//   - {@link reportPathFor}         — the report path under `<tempRoot>/qa/`.
+//   - {@link writeCoverageReport}   — render + write the markdown to disk.
+//
+// `renderCoverageReport` does no I/O so it stays trivially unit-testable;
+// `writeCoverageReport` accepts an injectable `fsImpl` (default `node:fs`)
+// for the same reason, mirroring `lib/qa/qa-session.js`.
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+import { tempRootFrom } from '../config/temp-paths.js';
+import { acceptanceMatrix, TIERS } from './coverage-verdict.js';
+
+/** Directory segment (under `tempRoot`) that holds QA coverage reports. */
+export const QA_REPORT_DIRNAME = 'qa';
+
+/** Cell glyph for each verdict status, used in the markdown matrix table. */
+const STATUS_GLYPH = Object.freeze({
+  present: '✅ present',
+  absent: '❌ absent',
+});
+
+/** Title-case a tier name for the table header (`unit` → `Unit`). */
+function tierHeader(tier) {
+  return tier.charAt(0).toUpperCase() + tier.slice(1);
+}
+
+/**
+ * Escape the pipe character so a label never breaks the markdown table, and
+ * collapse newlines to spaces so a multi-line criterion stays on one row.
+ */
+function cell(value) {
+  return String(value ?? '')
+    .replace(/\r?\n/g, ' ')
+    .replace(/\|/g, '\\|')
+    .trim();
+}
+
+/**
+ * Resolve the matrix input. Accepts either a pre-built matrix
+ * (`{tiers, rows}` from {@link acceptanceMatrix}) or raw criteria (array or
+ * keyed object), in which case it is run through {@link acceptanceMatrix}.
+ *
+ * @param {object|Array} input
+ * @returns {{tiers: ReadonlyArray<string>, rows: Array}}
+ */
+function resolveMatrix(input) {
+  if (
+    input &&
+    typeof input === 'object' &&
+    !Array.isArray(input) &&
+    Array.isArray(input.rows)
+  ) {
+    return { tiers: input.tiers ?? TIERS, rows: input.rows };
+  }
+  return acceptanceMatrix(input);
+}
+
+/**
+ * Render an AC × test-tier coverage matrix to a markdown report string.
+ *
+ * The report has a title, a one-line summary of how many criteria are fully
+ * covered, the matrix table (one row per AC, one column per tier), and a
+ * per-criterion notes section explaining each absent tier.
+ *
+ * @param {{tiers?:ReadonlyArray<string>,rows:Array}|Array|object} input
+ *   Either a built matrix (`{tiers, rows}`) or raw criteria to build one from.
+ * @param {{ title?: string, generatedAt?: string }} [opts]
+ * @returns {string} The markdown report.
+ */
+export function renderCoverageReport(input, opts = {}) {
+  const { tiers, rows } = resolveMatrix(input);
+  const title =
+    typeof opts.title === 'string' && opts.title.trim() !== ''
+      ? opts.title.trim()
+      : 'QA Coverage — AC × Test-Tier Matrix';
+
+  const fullyCovered = rows.filter((row) =>
+    tiers.every((tier) => row.verdict[tier]?.status === 'present'),
+  ).length;
+
+  const lines = [];
+  lines.push(`# ${title}`);
+  lines.push('');
+  if (typeof opts.generatedAt === 'string' && opts.generatedAt.trim() !== '') {
+    lines.push(`_Generated: ${opts.generatedAt.trim()}_`);
+    lines.push('');
+  }
+  lines.push(
+    `${rows.length} acceptance criteri${rows.length === 1 ? 'on' : 'a'}, ` +
+      `${fullyCovered} fully covered across all ${tiers.length} tiers.`,
+  );
+  lines.push('');
+
+  // Matrix table.
+  const headerCells = ['Acceptance Criterion', ...tiers.map(tierHeader)];
+  lines.push(`| ${headerCells.join(' | ')} |`);
+  lines.push(`| ${headerCells.map(() => '---').join(' | ')} |`);
+  for (const row of rows) {
+    const acCell = cell(row.label ? `${row.id}: ${row.label}` : row.id);
+    const tierCells = tiers.map((tier) => {
+      const status = row.verdict[tier]?.status ?? 'absent';
+      return STATUS_GLYPH[status] ?? cell(status);
+    });
+    lines.push(`| ${[acCell, ...tierCells].join(' | ')} |`);
+  }
+  lines.push('');
+
+  // Per-criterion notes.
+  lines.push('## Notes');
+  lines.push('');
+  for (const row of rows) {
+    lines.push(
+      `### ${cell(row.id)}${row.label ? ` — ${cell(row.label)}` : ''}`,
+    );
+    for (const tier of tiers) {
+      const v = row.verdict[tier];
+      const status = v?.status ?? 'absent';
+      const note = v?.note ?? '';
+      lines.push(`- **${tierHeader(tier)}** (${status}): ${cell(note)}`);
+    }
+    lines.push('');
+  }
+
+  return `${lines.join('\n').trimEnd()}\n`;
+}
+
+/**
+ * The report path under `<tempRoot>/qa/`.
+ *
+ * @param {string} [fileName] Report file name (default `coverage-report.md`).
+ *   Path separators are rejected so a caller cannot escape the `qa/` dir.
+ * @param {object} [config] Resolved config bag (for `project.paths.tempRoot`).
+ * @returns {string}
+ */
+export function reportPathFor(fileName = 'coverage-report.md', config) {
+  const name = String(fileName);
+  if (name.includes('/') || name.includes('\\') || name === '..') {
+    throw new Error(
+      `[coverage-report] file name must not contain path separators; got ${JSON.stringify(name)}`,
+    );
+  }
+  return path.join(tempRootFrom(config), QA_REPORT_DIRNAME, name);
+}
+
+/**
+ * Render the matrix to markdown and write it under `<tempRoot>/qa/`, creating
+ * the directory if needed. Returns the resolved path and the rendered body.
+ *
+ * @param {{tiers?:ReadonlyArray<string>,rows:Array}|Array|object} input
+ *   Either a built matrix or raw criteria.
+ * @param {{
+ *   fileName?: string,
+ *   config?: object,
+ *   title?: string,
+ *   generatedAt?: string,
+ *   fsImpl?: typeof fs,
+ * }} [opts]
+ * @returns {{ path: string, markdown: string }}
+ */
+export function writeCoverageReport(input, opts = {}) {
+  const fsImpl = opts.fsImpl ?? fs;
+  const markdown = renderCoverageReport(input, {
+    title: opts.title,
+    generatedAt: opts.generatedAt,
+  });
+  const reportPath = reportPathFor(opts.fileName, opts.config);
+  fsImpl.mkdirSync(path.dirname(reportPath), { recursive: true });
+  fsImpl.writeFileSync(reportPath, markdown, 'utf8');
+  return { path: reportPath, markdown };
+}

package/.agents/scripts/lib/qa/coverage-verdict.js

@@ -0,0 +1,296 @@
+// .agents/scripts/lib/qa/coverage-verdict.js
+//
+// Deterministic per-tier coverage verdict for a single finding surface.
+//
+// A "finding surface" is the unit of code a quality finding points at — a
+// symbol (function / class / module export) together with the set of tests
+// that exercise it. This helper answers one question, purely and without I/O:
+// for that surface, which of the three test tiers from
+// `.agents/rules/testing-standards.md` (unit / contract / acceptance) are
+// PRESENT, and which are ABSENT — and why.
+//
+// A scenario that is skipped does not exercise anything — a `@skip` /
+// `@pending` Gherkin tag (or a runner equivalent such as `it.skip` / `xit` /
+// `describe.skip`, or a `skipped: true` descriptor field) means the test is
+// inert at run time. This module therefore treats a skipped test as ABSENT
+// for its tier: it never bumps a tier into `present`, because a tier whose
+// only "coverage" is a skipped scenario is, operationally, uncovered.
+//
+// The companion process skill is `core/qa-coverage-mapping`, which shows how
+// to gather the surface input and act on the verdict. This module is the
+// deterministic seam that skill delegates to; it makes no network calls, runs
+// no child processes, and reads no environment or files.
+//
+// Public API:
+//
+//   coverageVerdict(surface) -> {
+//     unit:       { status, note },
+//     contract:   { status, note },
+//     acceptance: { status, note },
+//   }
+//
+//   status is 'present' when the tier has at least one classified,
+//   non-skipped test, or 'absent' otherwise. `note` is a short
+//   operator-facing string explaining the verdict (always populated,
+//   including for present tiers).
+//
+//   acceptanceMatrix(criteria) -> {
+//     tiers: TIERS,
+//     rows: [{ id, label, verdict }, ...],
+//   }
+//
+//   Maps each acceptance criterion to its per-tier `coverageVerdict`, giving
+//   the AC × test-tier matrix the markdown report (lib/qa/coverage-report.js)
+//   renders.
+
+/** The three test tiers, in pyramid order (base → top). */
+export const TIERS = Object.freeze(['unit', 'contract', 'acceptance']);
+
+const PRESENT = 'present';
+const ABSENT = 'absent';
+
+/** True when `value` contains a `@skip` or `@pending` Gherkin-style tag. */
+function hasSkipTag(value) {
+  if (typeof value !== 'string') return false;
+  return /(^|[\s,])@(skip|pending)\b/i.test(value);
+}
+
+/** True when `value` contains a runner-level skip/pending marker. */
+function hasRunnerSkipMarker(value) {
+  if (typeof value !== 'string') return false;
+  if (/\b(?:it|test|describe|context)\.(?:skip|todo)\b/i.test(value)) {
+    return true;
+  }
+  return /\bx(?:it|test|describe|context)\b/i.test(value);
+}
+
+/**
+ * True when a test descriptor is marked skipped/pending and therefore must
+ * NOT count toward its tier. Recognizes:
+ *   - a `@skip` / `@pending` tag in a `tags` array or whitespace/comma string,
+ *   - the same tags embedded in a path or descriptor `name`,
+ *   - explicit boolean flags (`skipped`, `pending`),
+ *   - runner skip markers in a path/name (`it.skip`, `xit`, `xdescribe`,
+ *     `describe.skip`, `test.skip`, `.todo`).
+ *
+ * @param {string|object} test
+ * @returns {boolean}
+ */
+export function isSkipped(test) {
+  if (test == null) return false;
+
+  if (typeof test === 'object') {
+    // 1. Explicit boolean flags win.
+    if (test.skipped === true || test.pending === true) return true;
+
+    // 2. A `tags` field — array of tag strings or a single string.
+    const tags = test.tags;
+    if (Array.isArray(tags)) {
+      if (tags.some((t) => hasSkipTag(t))) return true;
+    } else if (typeof tags === 'string' && hasSkipTag(tags)) {
+      return true;
+    }
+  }
+
+  // 3. Scan a path/name string for an inline skip/pending tag or a runner
+  //    skip marker (covers both string inputs and descriptor `path`/`name`).
+  const scannable =
+    typeof test === 'string'
+      ? test
+      : typeof test === 'object'
+        ? [test.path, test.name].filter((s) => typeof s === 'string').join(' ')
+        : '';
+  return hasSkipTag(scannable) || hasRunnerSkipMarker(scannable);
+}
+
+/**
+ * Classify a single test descriptor into one of the three tiers, or `null`
+ * when it cannot be placed OR when it is skipped/pending. Tier placement
+ * mirrors `.agents/rules/testing-standards.md`:
+ *   - unit       — colocated `*.test.*` next to source, or under `__tests__/`.
+ *   - contract   — lives under a `tests/contract/**` (or `**\/contract\/**`)
+ *                  path.
+ *   - acceptance — a Gherkin `.feature` file (e2e / acceptance tier).
+ *
+ * An explicit `tier` field on the descriptor always wins over path inference,
+ * so callers that already know the tier can state it directly.
+ *
+ * A skipped/pending test (see {@link isSkipped}) is treated as inert and
+ * returns `null` so it never counts toward its tier — a tier covered only by
+ * a skipped scenario is, operationally, uncovered.
+ */
+export function classifyTest(test) {
+  if (test == null) return null;
+
+  // A skipped/pending test exercises nothing — it cannot place into any tier.
+  if (isSkipped(test)) return null;
+
+  // 1. Explicit tier wins.
+  const explicit =
+    typeof test === 'object' && typeof test.tier === 'string'
+      ? test.tier.trim().toLowerCase()
+      : null;
+  if (explicit && TIERS.includes(explicit)) {
+    return explicit;
+  }
+
+  // 2. Infer from a path string.
+  const rawPath =
+    typeof test === 'string'
+      ? test
+      : typeof test === 'object' && typeof test.path === 'string'
+        ? test.path
+        : null;
+  if (!rawPath) return null;
+
+  const p = rawPath.replace(/\\/g, '/').toLowerCase();
+
+  if (p.endsWith('.feature')) return 'acceptance';
+  if (/(^|\/)contract\//.test(p) || /\.contract\.test\.[cm]?[jt]sx?$/.test(p)) {
+    return 'contract';
+  }
+  if (/\.test\.[cm]?[jt]sx?$/.test(p) || /(^|\/)__tests__\//.test(p)) {
+    return 'unit';
+  }
+  return null;
+}
+
+const ABSENT_NOTES = Object.freeze({
+  unit: 'no colocated unit test exercises this surface',
+  contract: 'no contract test asserts this surface’s wire shape or boundary',
+  acceptance: 'no acceptance scenario covers a user-visible journey here',
+});
+
+const PRESENT_NOTES = Object.freeze({
+  unit: (n) => `${n} unit test${n === 1 ? '' : 's'} present`,
+  contract: (n) => `${n} contract test${n === 1 ? '' : 's'} present`,
+  acceptance: (n) => `${n} acceptance scenario${n === 1 ? '' : 's'} present`,
+});
+
+/**
+ * Compute the per-tier coverage verdict for one finding surface.
+ *
+ * @param {object} surface
+ * @param {string} [surface.symbol] - The symbol the finding points at; echoed
+ *   into notes for operator context. Optional.
+ * @param {Array<string|{path?:string,tier?:string,tags?:string|string[],skipped?:boolean,pending?:boolean}>} [surface.tests] -
+ *   The tests that exercise the surface. Each entry is either a path string or
+ *   a descriptor with `path`, `tier`, and/or skip markers (`tags`, `skipped`,
+ *   `pending`). Unclassifiable and skipped/pending entries are ignored.
+ * @returns {{unit:{status:string,note:string},
+ *            contract:{status:string,note:string},
+ *            acceptance:{status:string,note:string}}}
+ */
+export function coverageVerdict(surface = {}) {
+  if (surface === null || typeof surface !== 'object') {
+    throw new TypeError('coverageVerdict: surface must be an object');
+  }
+
+  const tests = Array.isArray(surface.tests) ? surface.tests : [];
+  const symbol =
+    typeof surface.symbol === 'string' && surface.symbol.trim() !== ''
+      ? surface.symbol.trim()
+      : null;
+
+  const counts = { unit: 0, contract: 0, acceptance: 0 };
+  for (const test of tests) {
+    const tier = classifyTest(test);
+    if (tier) counts[tier] += 1;
+  }
+
+  const verdict = {};
+  for (const tier of TIERS) {
+    const n = counts[tier];
+    if (n > 0) {
+      verdict[tier] = {
+        status: PRESENT,
+        note: PRESENT_NOTES[tier](n),
+      };
+    } else {
+      const base = ABSENT_NOTES[tier];
+      verdict[tier] = {
+        status: ABSENT,
+        note: symbol ? `${base} (${symbol})` : base,
+      };
+    }
+  }
+
+  return verdict;
+}
+
+/**
+ * Normalize a single criterion descriptor into `{id, label, surface}`. A
+ * descriptor may carry `id`, `label` (falls back to id), and either a nested
+ * `surface` or a flat `{symbol, tests}` shape.
+ */
+function normalizeOne(entry, index) {
+  const e = entry && typeof entry === 'object' ? entry : {};
+  const id =
+    typeof e.id === 'string' && e.id.trim() !== ''
+      ? e.id.trim()
+      : `AC-${index + 1}`;
+  const label =
+    typeof e.label === 'string' && e.label.trim() !== '' ? e.label.trim() : id;
+
+  let surface;
+  if (e.surface && typeof e.surface === 'object') {
+    surface = e.surface;
+  } else if (Array.isArray(e.tests) || typeof e.symbol === 'string') {
+    surface = { symbol: e.symbol, tests: e.tests };
+  } else {
+    surface = {};
+  }
+
+  return { id, label, surface };
+}
+
+/**
+ * Normalize the criteria input for {@link acceptanceMatrix}. Accepts either an
+ * array of criterion descriptors or a plain object keyed by criterion id whose
+ * values are surfaces (or `{surface}` wrappers). Returns a normalized array of
+ * `{id, label, surface}`.
+ *
+ * @param {Array<object>|object} criteria
+ * @returns {Array<{id:string,label:string,surface:object}>}
+ */
+function normalizeCriteria(criteria) {
+  if (Array.isArray(criteria)) {
+    return criteria.map((entry, index) => normalizeOne(entry, index));
+  }
+  if (criteria && typeof criteria === 'object') {
+    return Object.entries(criteria).map(([id, value], index) =>
+      normalizeOne(
+        value && typeof value === 'object' && !Array.isArray(value)
+          ? { id, ...value }
+          : { id, surface: { tests: value } },
+        index,
+      ),
+    );
+  }
+  throw new TypeError(
+    'acceptanceMatrix: criteria must be an array or an object',
+  );
+}
+
+/**
+ * Build the AC × test-tier matrix: for each acceptance criterion, the per-tier
+ * {@link coverageVerdict}. This is the structured shape the markdown report
+ * (`lib/qa/coverage-report.js`) renders into a table.
+ *
+ * @param {Array<{id?:string,label?:string,surface?:object,symbol?:string,tests?:Array}>|Record<string,object>} criteria
+ *   Acceptance criteria, either as an array of descriptors or an object keyed
+ *   by criterion id. Each descriptor names a surface (nested `surface`, or a
+ *   flat `{symbol, tests}`).
+ * @returns {{tiers: ReadonlyArray<string>,
+ *            rows: Array<{id:string,label:string,
+ *                         verdict:ReturnType<typeof coverageVerdict>}>}}
+ */
+export function acceptanceMatrix(criteria) {
+  const normalized = normalizeCriteria(criteria);
+  const rows = normalized.map(({ id, label, surface }) => ({
+    id,
+    label,
+    verdict: coverageVerdict(surface),
+  }));
+  return { tiers: TIERS, rows };
+}