pumuki 6.3.70 → 6.3.72

package/scripts/consumer-menu-matrix-baseline-report-lib.ts

@@ -4,10 +4,11 @@ import type {
   ConsumerMenuMatrixReport,
   MatrixOptionId,
 } from './framework-menu-matrix-baseline-lib';
+import { MATRIX_MENU_OPTION_IDS } from './framework-menu-matrix-evidence-lib';
 import type { DoctorDeepCheckLayer, LifecycleDoctorReport } from '../integrations/lifecycle/doctor';
 import type { LifecycleStatus } from '../integrations/lifecycle/status';
 
-const OPTION_IDS: ReadonlyArray<MatrixOptionId> = ['1', '2', '3', '4', '9'];
+const OPTION_IDS: ReadonlyArray<MatrixOptionId> = [...MATRIX_MENU_OPTION_IDS];
 const DOCTOR_LAYERS: ReadonlyArray<DoctorDeepCheckLayer> = [
   'core',
   'operational',
@@ -51,45 +52,19 @@ export type ConsumerMenuMatrixBaselineSnapshot = {
   };
 };
 
+const UNKNOWN_OPTION_REPORT = {
+  stage: 'UNKNOWN',
+  outcome: 'UNKNOWN',
+  filesScanned: 0,
+  totalViolations: 0,
+  diagnosis: 'unknown' as const,
+};
+
 const buildEmptyRound = (): ConsumerMenuMatrixReport => {
   return {
-    byOption: {
-      '1': {
-        stage: 'UNKNOWN',
-        outcome: 'UNKNOWN',
-        filesScanned: 0,
-        totalViolations: 0,
-        diagnosis: 'unknown',
-      },
-      '2': {
-        stage: 'UNKNOWN',
-        outcome: 'UNKNOWN',
-        filesScanned: 0,
-        totalViolations: 0,
-        diagnosis: 'unknown',
-      },
-      '3': {
-        stage: 'UNKNOWN',
-        outcome: 'UNKNOWN',
-        filesScanned: 0,
-        totalViolations: 0,
-        diagnosis: 'unknown',
-      },
-      '4': {
-        stage: 'UNKNOWN',
-        outcome: 'UNKNOWN',
-        filesScanned: 0,
-        totalViolations: 0,
-        diagnosis: 'unknown',
-      },
-      '9': {
-        stage: 'UNKNOWN',
-        outcome: 'UNKNOWN',
-        filesScanned: 0,
-        totalViolations: 0,
-        diagnosis: 'unknown',
-      },
-    },
+    byOption: Object.fromEntries(
+      MATRIX_MENU_OPTION_IDS.map((id) => [id, { ...UNKNOWN_OPTION_REPORT }])
+    ) as ConsumerMenuMatrixReport['byOption'],
   };
 };
 

package/scripts/framework-menu-consumer-actions-lib.ts

@@ -9,6 +9,10 @@ export type ConsumerLegacyMenuContext = {
   runStrictRepoAndStaged: () => Promise<void>;
   runStrictStagedOnly: () => Promise<void>;
   runStandardCriticalHigh: () => Promise<void>;
+  runEngineStagedNoPreflight: () => Promise<void>;
+  runEngineUnstagedNoPreflight: () => Promise<void>;
+  runEngineStagedAndUnstagedNoPreflight: () => Promise<void>;
+  runEngineFullRepoNoPreflight: () => Promise<void>;
   runPatternChecks: () => Promise<void>;
   runEslintAudit: () => Promise<void>;
   runAstIntelligence: () => Promise<void>;
@@ -22,24 +26,44 @@ export const createConsumerLegacyMenuActions = (
   return [
     {
       id: '1',
-      label: 'Read-only full audit (repo analysis · PRE_COMMIT)',
+      label: 'Consumer preflight + gate: ALL tracked files (PRE_COMMIT · writes evidence)',
       execute: params.runFullAudit,
     },
     {
       id: '2',
-      label: 'Read-only strict REPO+STAGING (CI/CD · PRE_PUSH)',
+      label: 'Consumer preflight + gate: REPO+index contract (PRE_PUSH · disk skip risk if evidence tracked)',
       execute: params.runStrictRepoAndStaged,
     },
     {
       id: '3',
-      label: 'Read-only strict STAGING only (dev · PRE_COMMIT)',
+      label: 'Consumer preflight + gate: STAGED only (PRE_COMMIT)',
       execute: params.runStrictStagedOnly,
     },
     {
       id: '4',
-      label: 'Read-only audit of STAGED+UNSTAGED working tree (PRE_PUSH policy)',
+      label: 'Consumer preflight + gate: working tree (PRE_PUSH policy · disk skip risk if evidence tracked)',
       execute: params.runStandardCriticalHigh,
     },
+    {
+      id: '11',
+      label: 'Engine audit · STAGED only (no preflight · PRE_COMMIT)',
+      execute: params.runEngineStagedNoPreflight,
+    },
+    {
+      id: '12',
+      label: 'Engine audit · UNSTAGED only (no preflight · PRE_COMMIT)',
+      execute: params.runEngineUnstagedNoPreflight,
+    },
+    {
+      id: '13',
+      label: 'Engine audit · STAGED + UNSTAGED (no preflight · PRE_COMMIT)',
+      execute: params.runEngineStagedAndUnstagedNoPreflight,
+    },
+    {
+      id: '14',
+      label: 'Engine audit · FULL tracked repo (no preflight · PRE_COMMIT)',
+      execute: params.runEngineFullRepoNoPreflight,
+    },
     {
       id: '5',
       label: 'Legacy read-only pattern checks snapshot',

package/scripts/framework-menu-consumer-preflight-hints.ts

@@ -7,7 +7,8 @@ import type {
 } from './framework-menu-consumer-preflight-types';
 
 export const ACTIONABLE_HINTS_BY_CODE: Readonly<Record<string, string>> = {
-  EVIDENCE_MISSING: 'ejecuta una auditoría (1/2/3/4) para regenerar .ai_evidence.json.',
+  EVIDENCE_MISSING:
+    'ejecuta una auditoría (1/2/3/4 o motor 11–14) para regenerar .ai_evidence.json.',
   EVIDENCE_INVALID: 'regenera .ai_evidence.json desde una opción de auditoría.',
   EVIDENCE_STALE: 'refresca evidencia antes de continuar con commit/push.',
   EVIDENCE_TIMESTAMP_INVALID: 'regenera evidencia para obtener un timestamp válido.',
@@ -54,7 +55,9 @@ export const buildConsumerPreflightHints = (
   const actionableHintsByCode = resolveActionableHintsByCode(dependencies);
 
   if (hasViolationCode(violations, 'EVIDENCE_MISSING')) {
-    hints.push('Evidence missing: ejecuta una auditoría (1/2/3/4) para regenerar .ai_evidence.json.');
+    hints.push(
+      'Evidence missing: ejecuta una auditoría (1/2/3/4 o motor 11–14) para regenerar .ai_evidence.json.'
+    );
     handledCodes.add('EVIDENCE_MISSING');
   }
   if (hasViolationCode(violations, 'EVIDENCE_INVALID')) {

package/scripts/framework-menu-consumer-runtime-actions.ts

@@ -5,6 +5,7 @@ import {
   exportConsumerRuntimeMarkdown,
   notifyConsumerRuntimeAuditSummary,
   printConsumerRuntimeEmptyScopeHint,
+  printPrePushTrackedEvidenceDiskHint,
   renderConsumerRuntimeAstBreakdown,
   renderConsumerRuntimeEslintAudit,
   renderConsumerRuntimeFileDiagnostics,
@@ -20,7 +21,9 @@ type ConsumerRuntimeActionDependencies = {
   runRepoGate: () => Promise<ConsumerRuntimeGateResult | void>;
   runRepoAndStagedGate: () => Promise<ConsumerRuntimeGateResult | void>;
   runStagedGate: () => Promise<ConsumerRuntimeGateResult | void>;
+  runUnstagedGate: () => Promise<ConsumerRuntimeGateResult | void>;
   runWorkingTreeGate: () => Promise<ConsumerRuntimeGateResult | void>;
+  runWorkingTreePreCommitGate: () => Promise<ConsumerRuntimeGateResult | void>;
   runPreflight?: (
     stage: 'PRE_COMMIT' | 'PRE_PUSH'
   ) => Promise<string | void> | string | void;
@@ -88,18 +91,25 @@ export const createConsumerRuntimeActions = (
       } else {
         dependencies.clearSummaryOverride();
       }
+      const summary = renderConsumerRuntimeSummary({
+        repoRoot: dependencies.repoRoot,
+        write: dependencies.write,
+        useColor: dependencies.useColor,
+        summaryOverride: dependencies.getSummaryOverride(),
+      });
       notifyConsumerRuntimeAuditSummary(
         {
           emitNotification: dependencies.emitNotification,
           repoRoot: dependencies.repoRoot,
         },
-        renderConsumerRuntimeSummary({
-          repoRoot: dependencies.repoRoot,
-          write: dependencies.write,
-          useColor: dependencies.useColor,
-          summaryOverride: dependencies.getSummaryOverride(),
-        })
+        summary
       );
+      if (
+        !gateResult?.blocked
+        && (summary.outcome === 'PASS' || summary.outcome === 'WARN')
+      ) {
+        printPrePushTrackedEvidenceDiskHint({ write: dependencies.write });
+      }
     },
     runStrictStagedOnly: async () => {
       await runConsumerRuntimePreflight(dependencies, 'PRE_COMMIT');
@@ -135,8 +145,78 @@ export const createConsumerRuntimeActions = (
         },
         summary
       );
+      if (summary.outcome === 'PASS' || summary.outcome === 'WARN') {
+        printPrePushTrackedEvidenceDiskHint({ write: dependencies.write });
+      }
       printConsumerRuntimeEmptyScopeHint({ write: dependencies.write }, summary, 'workingTree');
     },
+    runEngineStagedNoPreflight: async () => {
+      await dependencies.runStagedGate();
+      dependencies.clearSummaryOverride();
+      const summary = renderConsumerRuntimeSummary({
+        repoRoot: dependencies.repoRoot,
+        write: dependencies.write,
+        useColor: dependencies.useColor,
+      });
+      notifyConsumerRuntimeAuditSummary(
+        {
+          emitNotification: dependencies.emitNotification,
+          repoRoot: dependencies.repoRoot,
+        },
+        summary
+      );
+      printConsumerRuntimeEmptyScopeHint({ write: dependencies.write }, summary, 'staged');
+    },
+    runEngineUnstagedNoPreflight: async () => {
+      await dependencies.runUnstagedGate();
+      dependencies.clearSummaryOverride();
+      const summary = renderConsumerRuntimeSummary({
+        repoRoot: dependencies.repoRoot,
+        write: dependencies.write,
+        useColor: dependencies.useColor,
+      });
+      notifyConsumerRuntimeAuditSummary(
+        {
+          emitNotification: dependencies.emitNotification,
+          repoRoot: dependencies.repoRoot,
+        },
+        summary
+      );
+      printConsumerRuntimeEmptyScopeHint({ write: dependencies.write }, summary, 'unstaged');
+    },
+    runEngineStagedAndUnstagedNoPreflight: async () => {
+      await dependencies.runWorkingTreePreCommitGate();
+      dependencies.clearSummaryOverride();
+      const summary = renderConsumerRuntimeSummary({
+        repoRoot: dependencies.repoRoot,
+        write: dependencies.write,
+        useColor: dependencies.useColor,
+      });
+      notifyConsumerRuntimeAuditSummary(
+        {
+          emitNotification: dependencies.emitNotification,
+          repoRoot: dependencies.repoRoot,
+        },
+        summary
+      );
+      printConsumerRuntimeEmptyScopeHint({ write: dependencies.write }, summary, 'workingTree');
+    },
+    runEngineFullRepoNoPreflight: async () => {
+      await dependencies.runRepoGate();
+      dependencies.clearSummaryOverride();
+      const summary = renderConsumerRuntimeSummary({
+        repoRoot: dependencies.repoRoot,
+        write: dependencies.write,
+        useColor: dependencies.useColor,
+      });
+      notifyConsumerRuntimeAuditSummary(
+        {
+          emitNotification: dependencies.emitNotification,
+          repoRoot: dependencies.repoRoot,
+        },
+        summary
+      );
+    },
     runPatternChecks: async () => {
       dependencies.write(`\n${renderConsumerRuntimePatternChecks(dependencies.repoRoot)}\n`);
     },

package/scripts/framework-menu-consumer-runtime-audit.ts

@@ -14,6 +14,7 @@ import {
   readEvidenceSummaryForMenu,
   type FrameworkMenuEvidenceSummary,
 } from './framework-menu-evidence-summary-lib';
+import { renderVintageEvidenceReport } from './framework-menu-consumer-runtime-evidence-classic';
 import type {
   ConsumerRuntimeBlockedGate,
   ConsumerRuntimeNotificationDependencies,
@@ -56,9 +57,36 @@ export const renderConsumerRuntimeSummary = (
     width: resolveLegacyPanelOuterWidth(),
     color: dependencies.useColor(),
   })}\n`);
+
+  const vintageSource =
+    summary.status === 'ok' && !dependencies.summaryOverride
+      ? readEvidenceSummaryForMenu(dependencies.repoRoot, {
+        topFindingsLimit: 45,
+        topFileLocationsLimit: 15,
+        topFilesLimit: 10,
+      })
+      : summary;
+  renderVintageEvidenceReport({
+    write: dependencies.write,
+    summary: vintageSource,
+    useColor: dependencies.useColor,
+  });
   return summary;
 };
 
+export const printPrePushTrackedEvidenceDiskHint = (params: {
+  write: ConsumerRuntimeSummaryDependencies['write'];
+}): void => {
+  params.write(
+    '\n' +
+      [
+        'ℹ PRE_PUSH + `.ai_evidence.json` tracked: on PASS/WARN the gate may skip rewriting the file on disk',
+        '  (avoids dirty tracked evidence). Local dev: PUMUKI_PRE_PUSH_ALWAYS_WRITE_TRACKED_EVIDENCE=1 forces disk write.',
+      ].join('\n') +
+      '\n'
+  );
+};
+
 export const buildConsumerRuntimeBlockedSummary = (
   blocked: ConsumerRuntimeBlockedGate
 ): FrameworkMenuEvidenceSummary => ({
@@ -116,12 +144,18 @@ export const printConsumerRuntimeEmptyScopeHint = (
   }
   if (scope === 'staged') {
     dependencies.write(
-      '\nℹ Scope vacío (staged): no hay archivos soportados en staged para auditar. Resultado PASS por alcance vacío; usa 1 o 2 para validar repo completo.\n'
+      '\nℹ Scope vacío (staged): no hay archivos soportados en staged para auditar. Resultado PASS por alcance vacío; usa 1, 2 o 14 (repo completo) según necesidad.\n'
+    );
+    return;
+  }
+  if (scope === 'unstaged') {
+    dependencies.write(
+      '\nℹ Scope vacío (unstaged): no hay cambios sin stage ni untracked auditable. Resultado PASS por alcance vacío; usa 1, 14 u opciones 11–13 según el alcance que necesites.\n'
     );
     return;
   }
   dependencies.write(
-    '\nℹ Scope vacío (working tree): no hay archivos soportados en staged/unstaged para auditar. Resultado PASS por alcance vacío; usa 1 o 2 para validar repo completo.\n'
+    '\nℹ Scope vacío (working tree): no hay archivos soportados en staged/unstaged para auditar. Resultado PASS por alcance vacío; usa 1, 2, 13 o 14 según el alcance que necesites.\n'
   );
 };
 

package/scripts/framework-menu-consumer-runtime-evidence-classic.ts

@@ -0,0 +1,140 @@
+import type { EnterpriseEvidenceSeverity } from './framework-menu-evidence-summary-types';
+import type { FrameworkMenuEvidenceSummary } from './framework-menu-evidence-summary-lib';
+import { renderLegacyPanel, resolveLegacyPanelOuterWidth } from './framework-menu-legacy-audit-lib';
+import { applyCliPalette, buildCliDesignTokens } from './framework-menu-ui-components-lib';
+import type { CliPaletteRole } from './framework-menu-ui-components-types';
+
+const enterpriseSeverityToRole = (severity: EnterpriseEvidenceSeverity): CliPaletteRole => {
+  if (severity === 'CRITICAL') {
+    return 'critical';
+  }
+  if (severity === 'HIGH') {
+    return 'high';
+  }
+  if (severity === 'MEDIUM') {
+    return 'medium';
+  }
+  return 'low';
+};
+
+const outcomeToRole = (outcome: string | null): CliPaletteRole => {
+  const normalized = (outcome ?? '').trim().toUpperCase();
+  if (normalized === 'BLOCK' || normalized === 'BLOCKED') {
+    return 'critical';
+  }
+  if (normalized === 'WARN') {
+    return 'statusWarning';
+  }
+  if (normalized === 'PASS' || normalized === 'ALLOW' || normalized === 'ALLOWED') {
+    return 'goal';
+  }
+  return 'sectionTitle';
+};
+
+export const formatVintageEvidenceReportLines = (
+  summary: FrameworkMenuEvidenceSummary,
+  tokens: ReturnType<typeof buildCliDesignTokens>
+): string[] => {
+  if (summary.status !== 'ok') {
+    return [
+      applyCliPalette('PUMUKI — Classic evidence view', 'title', tokens),
+      applyCliPalette(
+        summary.status === 'missing'
+          ? 'No .ai_evidence.json — run an engine audit (1, 11–14) first.'
+          : 'Invalid .ai_evidence.json — regenerate from a gate run.',
+        'muted',
+        tokens
+      ),
+    ];
+  }
+
+  const ent = summary.byEnterpriseSeverity ?? {
+    CRITICAL: summary.bySeverity.CRITICAL,
+    HIGH: summary.bySeverity.ERROR,
+    MEDIUM: summary.bySeverity.WARN,
+    LOW: summary.bySeverity.INFO,
+  };
+
+  const lines: string[] = [
+    applyCliPalette('PUMUKI — Classic evidence view (severities + platforms)', 'title', tokens),
+    '',
+    `${applyCliPalette('Stage', 'sectionTitle', tokens)}: ${summary.stage ?? 'unknown'}  ${applyCliPalette('Outcome', 'sectionTitle', tokens)}: ${applyCliPalette(String(summary.outcome ?? 'unknown'), outcomeToRole(summary.outcome), tokens)}`,
+    `${applyCliPalette('Findings', 'sectionTitle', tokens)}: ${summary.totalFindings}  ${applyCliPalette('Scanned', 'muted', tokens)}: ${summary.filesScanned}  ${applyCliPalette('Affected', 'muted', tokens)}: ${summary.filesAffected}`,
+    '',
+    applyCliPalette('Enterprise severities', 'sectionTitle', tokens),
+  ];
+
+  const order: EnterpriseEvidenceSeverity[] = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW'];
+  for (const band of order) {
+    const count = ent[band] ?? 0;
+    if (count === 0) {
+      continue;
+    }
+    lines.push(
+      `  ${applyCliPalette(`${band}:`, enterpriseSeverityToRole(band), tokens)} ${count}`
+    );
+  }
+
+  lines.push('', applyCliPalette('Legacy severities', 'sectionTitle', tokens));
+  lines.push(
+    `  ${applyCliPalette('CRITICAL', 'critical', tokens)} ${summary.bySeverity.CRITICAL}  ` +
+      `${applyCliPalette('ERROR', 'high', tokens)} ${summary.bySeverity.ERROR}  ` +
+      `${applyCliPalette('WARN', 'medium', tokens)} ${summary.bySeverity.WARN}  ` +
+      `${applyCliPalette('INFO', 'low', tokens)} ${summary.bySeverity.INFO}`
+  );
+
+  if (summary.platformAuditRows && summary.platformAuditRows.length > 0) {
+    lines.push('', applyCliPalette('Platforms (from evidence snapshot)', 'sectionTitle', tokens));
+    for (const row of summary.platformAuditRows) {
+      lines.push(
+        `  ${applyCliPalette(row.platform, 'rule', tokens)}: ${row.violations} violations`
+      );
+    }
+    lines.push(
+      applyCliPalette(
+        'Note: platform buckets are heuristic (path + ruleId); "Other" is not absence of iOS/Android work.',
+        'muted',
+        tokens
+      )
+    );
+  }
+
+  lines.push('', applyCliPalette('Top violations (ranked)', 'sectionTitle', tokens));
+  if (summary.topFindings.length === 0) {
+    lines.push(applyCliPalette('  (none)', 'goal', tokens));
+  } else {
+    for (const finding of summary.topFindings) {
+      const role = enterpriseSeverityToRole(finding.severity);
+      lines.push(
+        `  ${applyCliPalette(`[${finding.severity}]`, role, tokens)} ${finding.ruleId}`
+      );
+      lines.push(
+        `      ${applyCliPalette(`${finding.file}:${finding.line}`, 'muted', tokens)}`
+      );
+    }
+  }
+
+  return lines;
+};
+
+export const renderVintageEvidenceReport = (params: {
+  write: (text: string) => void;
+  summary: FrameworkMenuEvidenceSummary;
+  useColor: () => boolean;
+}): void => {
+  if (process.env.PUMUKI_MENU_VINTAGE_REPORT === '0') {
+    return;
+  }
+  const tokens = buildCliDesignTokens({
+    width: resolveLegacyPanelOuterWidth(),
+    color: params.useColor(),
+  });
+
+  const lines = formatVintageEvidenceReportLines(params.summary, tokens);
+  params.write(
+    `\n${renderLegacyPanel(lines, {
+      width: resolveLegacyPanelOuterWidth(),
+      color: params.useColor(),
+    })}\n`
+  );
+};

package/scripts/framework-menu-consumer-runtime-lib.ts

@@ -35,7 +35,9 @@ export const createConsumerMenuRuntime = (
     runRepoGate: params.runRepoGate,
     runRepoAndStagedGate: params.runRepoAndStagedGate,
     runStagedGate: params.runStagedGate,
+    runUnstagedGate: params.runUnstagedGate,
     runWorkingTreeGate: params.runWorkingTreeGate,
+    runWorkingTreePreCommitGate: params.runWorkingTreePreCommitGate,
     runPreflight: params.runPreflight,
     emitNotification,
     clearSummaryOverride: () => {

package/scripts/framework-menu-consumer-runtime-types.ts

@@ -33,7 +33,9 @@ export type ConsumerMenuRuntimeParams = {
   runRepoGate: () => Promise<ConsumerRuntimeGateResult | void>;
   runRepoAndStagedGate: () => Promise<ConsumerRuntimeGateResult | void>;
   runStagedGate: () => Promise<ConsumerRuntimeGateResult | void>;
+  runUnstagedGate: () => Promise<ConsumerRuntimeGateResult | void>;
   runWorkingTreeGate: () => Promise<ConsumerRuntimeGateResult | void>;
+  runWorkingTreePreCommitGate: () => Promise<ConsumerRuntimeGateResult | void>;
   runPreflight?: (
     stage: 'PRE_COMMIT' | 'PRE_PUSH'
   ) => Promise<string | void> | string | void;
@@ -47,7 +49,7 @@ export type ConsumerMenuRuntime = {
   readCurrentSummary: () => FrameworkMenuEvidenceSummary | null;
 };
 
-export type ConsumerRuntimeScope = 'staged' | 'workingTree';
+export type ConsumerRuntimeScope = 'staged' | 'unstaged' | 'workingTree';
 
 export type ConsumerRuntimeSummaryDependencies = {
   repoRoot: string;

package/scripts/framework-menu-evidence-summary-lib.ts

@@ -3,5 +3,6 @@ export type {
   EvidenceSeverity,
   FrameworkMenuEvidenceSummary,
 } from './framework-menu-evidence-summary-types';
+export type { ReadEvidenceSummaryForMenuOptions } from './framework-menu-evidence-summary-read';
 export { readEvidenceSummaryForMenu } from './framework-menu-evidence-summary-read';
 export { formatEvidenceSummaryForMenu } from './framework-menu-evidence-summary-format';

package/scripts/framework-menu-evidence-summary-read.ts

@@ -1,4 +1,8 @@
-import type { FrameworkMenuEvidenceSummary } from './framework-menu-evidence-summary-types';
+import type {
+  EvidenceSnapshot,
+  FrameworkMenuEvidencePlatformRow,
+  FrameworkMenuEvidenceSummary,
+} from './framework-menu-evidence-summary-types';
 import { readEvidenceSummaryFile } from './framework-menu-evidence-summary-file';
 import {
   asFindings,
@@ -16,9 +20,55 @@ import {
   toTopFiles,
 } from './framework-menu-evidence-summary-severity';
 
+export type ReadEvidenceSummaryForMenuOptions = {
+  topFindingsLimit?: number;
+  topFileLocationsLimit?: number;
+  topFilesLimit?: number;
+};
+
+const sumLegacySeverityBand = (row: { by_severity?: unknown }): number => {
+  const bands = row.by_severity;
+  if (!bands || typeof bands !== 'object') {
+    return 0;
+  }
+  const b = bands as Record<string, unknown>;
+  const keys = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW'] as const;
+  let total = 0;
+  for (const key of keys) {
+    const value = b[key];
+    if (typeof value === 'number' && Number.isFinite(value)) {
+      total += value;
+    }
+  }
+  return total;
+};
+
+const parsePlatformAuditRows = (
+  snapshot: EvidenceSnapshot
+): ReadonlyArray<FrameworkMenuEvidencePlatformRow> => {
+  const raw = snapshot.platforms;
+  if (!Array.isArray(raw)) {
+    return [];
+  }
+  const rows: FrameworkMenuEvidencePlatformRow[] = [];
+  for (const entry of raw) {
+    if (!entry || typeof entry !== 'object') {
+      continue;
+    }
+    const platform = toStringOrNull((entry as { platform?: unknown }).platform) ?? 'Other';
+    const violations = sumLegacySeverityBand(entry as { by_severity?: unknown });
+    rows.push({ platform, violations });
+  }
+  return rows;
+};
+
 export const readEvidenceSummaryForMenu = (
-  repoRoot: string = process.cwd()
+  repoRoot: string = process.cwd(),
+  options?: ReadEvidenceSummaryForMenuOptions
 ): FrameworkMenuEvidenceSummary => {
+  const topFindingsLimit = options?.topFindingsLimit ?? 10;
+  const topFileLocationsLimit = options?.topFileLocationsLimit ?? 10;
+  const topFilesLimit = options?.topFilesLimit ?? 5;
   const evidence = readEvidenceSummaryFile(repoRoot);
 
   if (evidence.status === 'missing') {
@@ -65,12 +115,13 @@ export const readEvidenceSummaryForMenu = (
     evidence.snapshot.files_affected ?? evidence.snapshot.filesAffected
   );
   const topFileLocations = countFiles({ findings, repoRoot })
-    .slice(0, 10)
+    .slice(0, topFileLocationsLimit)
     .map((entry) => ({
       file: entry.file,
       line: entry.line,
     }));
-  const topFindings = buildTopFindings({ findings, repoRoot, maxItems: 10 });
+  const topFindings = buildTopFindings({ findings, repoRoot, maxItems: topFindingsLimit });
+  const platformAuditRows = parsePlatformAuditRows(evidence.snapshot);
 
   return {
     status: 'ok',
@@ -81,8 +132,9 @@ export const readEvidenceSummaryForMenu = (
     filesAffected,
     bySeverity,
     byEnterpriseSeverity,
-    topFiles: toTopFiles({ findings, repoRoot }),
+    topFiles: toTopFiles({ findings, repoRoot, maxItems: topFilesLimit }),
     topFileLocations,
     topFindings,
+    ...(platformAuditRows.length > 0 ? { platformAuditRows } : {}),
   };
 };

package/scripts/framework-menu-evidence-summary-severity.ts

@@ -50,7 +50,9 @@ export const countFindingsBySeverity = (
 export const toTopFiles = (params: {
   findings: ReadonlyArray<EvidenceFinding>;
   repoRoot: string;
+  maxItems?: number;
 }): ReadonlyArray<{ file: string; count: number }> => {
+  const maxItems = params.maxItems ?? 5;
   const filesMap = new Map<string, number>();
   for (const finding of params.findings) {
     const rawFile = toStringOrNull(finding.file);
@@ -66,7 +68,7 @@ export const toTopFiles = (params: {
 
   return [...filesMap.entries()]
     .sort((left, right) => right[1] - left[1] || left[0].localeCompare(right[0]))
-    .slice(0, 5)
+    .slice(0, maxItems)
     .map(([file, count]) => ({ file, count }));
 };
 

package/scripts/framework-menu-evidence-summary-types.ts

@@ -18,12 +18,18 @@ export type EvidenceSnapshot = {
   stage?: unknown;
   outcome?: unknown;
   findings?: unknown;
+  platforms?: unknown;
 };
 
 export type EvidenceSeverityMetrics = {
   by_enterprise_severity?: unknown;
 };
 
+export type FrameworkMenuEvidencePlatformRow = {
+  platform: string;
+  violations: number;
+};
+
 export type FrameworkMenuEvidenceSummary = {
   status: 'ok' | 'missing' | 'invalid';
   stage: string | null;
@@ -41,4 +47,5 @@ export type FrameworkMenuEvidenceSummary = {
     file: string;
     line: number;
   }>;
+  platformAuditRows?: ReadonlyArray<FrameworkMenuEvidencePlatformRow>;
 };