swipium 1.4.0 → 2.0.0

package/dist/services/report.js

@@ -1,14 +1,19 @@
-// Report service (Phase 3.2 Milestone B) — the session-report assembly, extracted from the
+// Report service (Phase 3.2 Milestone B): the session-report assembly, extracted from the
 // qa_report tool so qa_test_this execute can produce a real report artifact in EVERY terminal
 // state (completed or blocked), not just tell the agent to call qa_report. qa_report is now a thin
 // wrapper around generateSessionReport().
 import { existsSync, writeFileSync } from 'node:fs';
-import { makeRedactor } from '../lib/redact.js';
+import { makeRedactor, redactDeep } from '../lib/redact.js';
+import { inputBindings } from '../suite/secretGuard.js';
+import { dedupeFindings, repeatSuffix } from '../report/findingsDedupe.js';
+import { toolVerdictFor } from '../report/toolHealth.js';
 import { getDriver } from '../session/attach.js';
 import { restoreNetwork } from '../tools/network.js';
 import { releaseAssessment } from '../report/summary.js';
 import { FAILURES, failureForFindingKind, bucketForNoteCategory, ALL_BUCKETS } from '../oracle/failures.js';
-import { inlinePrSummary, toMarkdown, toJUnit, toPlaywrightJson } from '../report/export.js';
+import { inlinePrSummary, redactReportData, reportPolicyVerdicts, toGithubSummary, toJUnit, toMarkdown, toPlaywrightJson, toSarif, } from '../report/export.js';
+import { applyPolicy, loadPolicy as loadReleasePolicy } from '../report/policy.js';
+import { resolveSarifSources } from '../report/sarifSources.js';
 import { generateFlow } from '../flows/generate.js';
 import { loadProjectConfig } from '../cli/scan.js';
 import { activeRecording } from '../tools/screenRecord.js';
@@ -32,11 +37,15 @@ import { resolveSourceRevision } from '../issues/sourceRevision.js';
 import { loadPolicy as loadIssuePolicy, getIndex as getIssueIndex, readEvents as readIssueEvents } from '../issues/store.js';
 import { computeIssueMetrics } from '../issues/metrics.js';
 import { verifyFixed } from '../issues/index.js';
-import { linkIssueToCase, linkRunIssue, relationshipForCase, runRelationshipFor, verifiedFixedIssuesForRun } from '../testSuite/issueLinks.js';
+import { linkIssueToCase, linkRunIssue, relationshipForCase, runRelationshipFor, verifiedFixedIssuesForRun, } from '../testSuite/issueLinks.js';
 import { saveSuite } from '../testSuite/store.js';
 import { pomForSession } from './suiteGenerate.js';
 import { generateCanonicalCases } from '../testSuite/generator.js';
 import { applyMerge, loadSuite, suiteDelta, runIdFromNow } from '../testSuite/store.js';
+/** Render an *Ms structured value as human-readable seconds for text summaries. */
+function secText(ms) {
+    return `${Math.round((ms ?? 0) / 1000)}s`;
+}
 export async function generateSessionReport(sessions, session, options = {}) {
     const { format, baseline, trendRoot } = options;
     const includeCurrentDump = options.includeCurrentDump ?? true;
@@ -48,7 +57,7 @@ export async function generateSessionReport(sessions, session, options = {}) {
         if (driver)
             networkRestore = (await restoreNetwork(sessions, session, driver)) ?? undefined;
         else
-            networkRestore = 'PENDING — Swipium changed the network but no device is attached to restore it';
+            networkRestore = 'PENDING: Swipium changed the network but no device is attached to restore it';
     }
     // Attach a redacted current dump (best-effort) for triage.
     let dumpUri;
@@ -63,6 +72,7 @@ export async function generateSessionReport(sessions, session, options = {}) {
     }
     const finalNetwork = driver ? ((await driver.airplaneOn().catch(() => false)) ? 'offline' : 'online') : 'unknown';
     const high = session.findings.filter((f) => f.severity === 'high');
+    const uniqueFindings = dedupeFindings(session.findings);
     const nativeFindings = session.findings.filter((f) => f.layer === 'native');
     const appFindings = session.findings.filter((f) => f.layer === 'app');
     const nativeHealth = nativeFindings.some((f) => f.severity === 'high') ? 'error' : 'OK';
@@ -79,7 +89,9 @@ export async function generateSessionReport(sessions, session, options = {}) {
         (a[n.outcome] ??= {})[cat] = (a[n.outcome][cat] ?? 0) + 1;
         return a;
     }, {});
-    const visualVerifications = notes.filter((n) => n.verifiedVisually).map((n) => ({
+    const visualVerifications = notes
+        .filter((n) => n.verifiedVisually)
+        .map((n) => ({
         workflow: n.workflow,
         outcome: n.outcome,
         evidenceKind: n.evidenceKind,
@@ -93,9 +105,9 @@ export async function generateSessionReport(sessions, session, options = {}) {
     const authState = a.loginPerformed
         ? 'login_performed'
         : a.authedAtStart === true && !a.loginScreenSeen
-            ? 'logged_in_at_start (persisted session — login skipped)'
+            ? 'logged_in_at_start (persisted session, login skipped)'
             : a.loginScreenSeen
-                ? 'auth_required_not_completed (login screen seen, no login performed — credentials may be missing)'
+                ? 'auth_required_not_completed (login screen seen, no login performed, credentials may be missing)'
                 : 'unknown (no auth signal observed)';
     const phaseTimings = phaseTimingsForSession(session);
     const ec = session.envChanges;
@@ -137,7 +149,13 @@ export async function generateSessionReport(sessions, session, options = {}) {
         bucketExamples[bucket] ??= `${n.workflow}: ${n.reason ? redact(n.reason) : n.outcome}`;
     }
     const dominantBucket = ALL_BUCKETS.filter((b) => bucketCounts[b] > 0).sort((x, y) => bucketCounts[y] - bucketCounts[x])[0] ?? null;
-    const failureBuckets = { counts: bucketCounts, total: totalFailures, classifiedPct: totalFailures ? Math.round((classified / totalFailures) * 100) : 100, dominant: dominantBucket, examples: bucketExamples };
+    const failureBuckets = {
+        counts: bucketCounts,
+        total: totalFailures,
+        classifiedPct: totalFailures ? Math.round((classified / totalFailures) * 100) : 100,
+        dominant: dominantBucket,
+        examples: bucketExamples,
+    };
     const blockedCount = outcomeTally.blocked ?? 0;
     const APP_OWNED_FAIL_CATEGORIES = new Set(['app_bug', 'other']);
     const appFailNotes = notes.filter((n) => n.outcome === 'fail' && (n.category == null || APP_OWNED_FAIL_CATEGORIES.has(n.category)));
@@ -155,14 +173,21 @@ export async function generateSessionReport(sessions, session, options = {}) {
         blockedCount: blockedCount + toolLimitationFailCount,
         overrideCount: session.envChanges.filter((c) => /OVERRIDE|GUARDRAIL|acknowledgeBundleRisk|allowLaunchWithoutMetro/i.test(c)).length,
         topHighFinding: topHigh ? redact(topHigh.detail) : undefined,
-        topFail: topAppFailNote ? { workflow: topAppFailNote.workflow, reason: topAppFailNote.reason ? redact(topAppFailNote.reason) : undefined } : undefined,
+        topFail: topAppFailNote
+            ? { workflow: topAppFailNote.workflow, reason: topAppFailNote.reason ? redact(topAppFailNote.reason) : undefined }
+            : undefined,
         topBlocked: topBlockedNote ? { workflow: topBlockedNote.workflow, recommendedSetup: topBlockedNote.recommendedSetup } : undefined,
     });
     const outcomesByWorkflow = notes.reduce((acc, n) => {
-        acc[n.workflow] = { outcome: n.outcome, category: n.category, reason: n.reason ? redact(n.reason) : undefined, artifactUris: n.artifactUris ?? [] };
+        acc[n.workflow] = {
+            outcome: n.outcome,
+            category: n.category,
+            reason: n.reason ? redact(n.reason) : undefined,
+            artifactUris: n.artifactUris ?? [],
+        };
         return acc;
     }, {});
-    const appId = session.appId ?? (loadProjectConfig(session.root)?.appId ?? null);
+    const appId = session.appId ?? loadProjectConfig(session.root)?.appId ?? null;
     const wdaConfig = driver instanceof WdaDriver ? loadWdaConfig(session.root) : null;
     const wdaReport = driver instanceof WdaDriver && wdaConfig
         ? {
@@ -174,11 +199,14 @@ export async function generateSessionReport(sessions, session, options = {}) {
             tuning: { timings: wdaTimingSummary(session), recommendations: wdaRecommendations(wdaConfig, session) },
         }
         : null;
-    const readiness = orderReadinessLabels([...readinessForSession(session, {
+    const readiness = orderReadinessLabels([
+        ...readinessForSession(session, {
             suiteRunnable: options.suite?.suiteRunnable,
             suiteReplayed: false,
             ciReady: false,
-        }), ...(options.suite?.readinessLabels ?? [])]);
+        }),
+        ...(options.suite?.readinessLabels ?? []),
+    ]);
     const automationReadiness = automationReadinessForSession(session, {
         suiteRunnable: options.suite?.suiteRunnable,
         suiteReplayed: false,
@@ -188,8 +216,15 @@ export async function generateSessionReport(sessions, session, options = {}) {
     const automationBackend = automationBackendForSession(session);
     const passNotes = notes.filter((n) => n.outcome === 'pass').length;
     const appVerdict = (() => {
-        if (nativeHealth === 'error' || appHealth === 'error' || high.some((f) => f.layer === 'app' || f.layer === 'native') || appFailCount > 0) {
-            const summary = topHigh ? (redact(topHigh.detail) ?? topHigh.detail) : topAppFailNote?.reason ? (redact(topAppFailNote.reason) ?? topAppFailNote.reason) : 'High severity app/native finding or failed app workflow observed.';
+        if (nativeHealth === 'error' ||
+            appHealth === 'error' ||
+            high.some((f) => f.layer === 'app' || f.layer === 'native') ||
+            appFailCount > 0) {
+            const summary = topHigh
+                ? (redact(topHigh.detail) ?? topHigh.detail)
+                : topAppFailNote?.reason
+                    ? (redact(topAppFailNote.reason) ?? topAppFailNote.reason)
+                    : 'High severity app/native finding or failed app workflow observed.';
             return { status: 'BLOCKED', summary };
         }
         if (appHealth === 'degraded')
@@ -198,27 +233,26 @@ export async function generateSessionReport(sessions, session, options = {}) {
     })();
     const coverageVerdict = (() => {
         if (blockedCount > 0 || toolLimitationNotes.length > 0 || session.exploration?.state === 'blocked') {
-            const summary = topBlockedNote?.recommendedSetup
-                ?? (toolLimitationNotes.length ? `A Swipium/tool limitation blocked ${toolLimitationNotes.length} workflow(s); see toolVerdict.` : 'A setup or precondition blocker limited coverage.');
+            const summary = topBlockedNote?.recommendedSetup ??
+                (toolLimitationNotes.length
+                    ? `A Swipium/tool limitation blocked ${toolLimitationNotes.length} workflow(s); see toolVerdict.`
+                    : 'A setup or precondition blocker limited coverage.');
             return { status: 'BLOCKED', summary };
         }
         if (!automationBackend.structured) {
-            return { status: 'PARTIAL', summary: 'Coverage was limited because the active backend is visual-only or lacks structured UI automation.' };
+            return {
+                status: 'PARTIAL',
+                summary: 'Coverage was limited because the active backend is visual-only or lacks structured UI automation.',
+            };
         }
         if (passNotes === 0 && !session.exploration && session.recordedActions.length === 0) {
             return { status: 'SMOKE_ONLY', summary: 'Only launch/setup evidence was collected.' };
         }
         return { status: 'COVERED', summary: 'Structured smoke/workflow evidence was collected.' };
     })();
-    const toolVerdict = (() => {
-        if (toolLimitationNotes.length === 0)
-            return { status: 'PASS', summary: 'No Swipium/MCP limitations recorded in this run.' };
-        const first = toolLimitationNotes[0];
-        return {
-            status: 'BLOCKED',
-            summary: `${toolLimitationNotes.length} workflow(s) limited by Swipium/MCP capabilities (for example ${first.workflow}${first.reason ? `: ${redact(first.reason) ?? first.reason}` : ''}). These are tool limitations, not app defects.`,
-        };
-    })();
+    // Tool status reflects recorded tool errors (WDA 404, UNKNOWN…) as well as mcp_limitation notes,
+    // never "PASS" after tool errors. Tool health only: it does not change the app verdict.
+    const toolVerdict = toolVerdictFor(toolLimitationNotes, session.toolErrors, redact);
     // Single product-facing QA level (Deliverable 6 / §3.11). Derived from the same evidence the
     // report already trusts: readiness labels and health. Honest by construction.
     const qaLevel = deriveQaLevel({
@@ -232,7 +266,7 @@ export async function generateSessionReport(sessions, session, options = {}) {
         ciReplayed: readiness.includes('ci_ready'),
     });
     // Universal run test catalog (Deliverable 4 / review #6): documents executed, skipped, blocked,
-    // and exploration-promoted workflows for EVERY run — even when no suite was generated.
+    // and exploration-promoted workflows for EVERY run, even when no suite was generated.
     const suiteReplayStatus = readiness.includes('ci_ready')
         ? 'fresh_state'
         : readiness.includes('replayed')
@@ -252,7 +286,7 @@ export async function generateSessionReport(sessions, session, options = {}) {
             method: n.method,
             verifiedVisually: n.verifiedVisually,
         })),
-        findings: session.findings.map((f) => ({ kind: f.kind, severity: f.severity, detail: redact(f.detail) ?? f.detail })),
+        findings: uniqueFindings.map((f) => ({ kind: f.kind, severity: f.severity, detail: redact(f.detail) ?? f.detail })),
         exploration: session.exploration
             ? {
                 screensVisited: session.exploration.summary.screensVisited,
@@ -268,9 +302,9 @@ export async function generateSessionReport(sessions, session, options = {}) {
         suiteReplayStatus,
         observed: readiness.includes('observed'),
     });
-    // Persistent QA test suite (SWIPIUM-REQ-06): a report run observes QA knowledge, so update the
+    // Persistent QA test suite: a report run observes QA knowledge, so update the
     // canonical suite under .swipium/test-suite.json and embed the per-run delta + canonical case ids.
-    // Best-effort — a suite-merge failure must never break report generation.
+    // Best-effort: a suite-merge failure must never break report generation.
     let persistentSuite = null;
     let mergedSuite;
     try {
@@ -288,7 +322,8 @@ export async function generateSessionReport(sessions, session, options = {}) {
                 now,
                 replayStatus: suiteReplayStatus,
             });
-            const applied = applyMerge(session.root, incoming, { source: 'report', mode: 'update', now, runId: runIdFromNow(now) }, appId ?? undefined);
+            const applied = applyMerge(session.root, redactDeep(incoming, redact), // defense in depth: no registered secret reaches test-suite.json / TC-*.yaml
+            { source: 'report', mode: 'update', now, runId: runIdFromNow(now) }, appId ?? undefined);
             mergedSuite = applied.result.suite;
             const delta = suiteDelta(applied.result.suite, applied.result);
             persistentSuite = {
@@ -301,13 +336,23 @@ export async function generateSessionReport(sessions, session, options = {}) {
         else {
             const suite = loadSuite(session.root, appId ?? undefined);
             mergedSuite = suite;
-            persistentSuite = { totalCases: suite.cases.length, created: [], updated: [], deprecated: [], failed: [], blocked: [], newlyAutomated: [], caseIds: suite.cases.map((c) => c.id) };
+            persistentSuite = {
+                totalCases: suite.cases.length,
+                created: [],
+                updated: [],
+                deprecated: [],
+                failed: [],
+                blocked: [],
+                newlyAutomated: [],
+                caseIds: suite.cases.map((c) => c.id),
+            };
         }
     }
     catch {
         persistentSuite = null;
     }
     const screenshots = session.artifacts.filter((art) => art.kind === 'screenshot');
+    const toolErrors = session.toolErrors ?? [];
     const report = {
         sessionId: session.id,
         executiveSummary,
@@ -333,6 +378,8 @@ export async function generateSessionReport(sessions, session, options = {}) {
         })),
         workaroundsAttempted: session.workarounds,
         inputsProvided: session.inputs.map((i) => ({ varName: i.varName, secret: i.secret, source: i.source })),
+        // Disclose degraded redaction after a server restart (secrets are never persisted).
+        redactionDegraded: session.redactionDegraded === true,
         generatedValues: session.generatedValues.map((g) => ({
             ...g,
             value: g.secret ? '<redacted>' : redact(g.value),
@@ -343,15 +390,32 @@ export async function generateSessionReport(sessions, session, options = {}) {
         finalNetwork,
         networkRestore: networkRestore ?? (session.network ? 'no change pending' : 'unchanged'),
         activeRecording: activeRecording(session.id) ?? null,
-        findings: session.findings.map((f) => {
+        // Identical findings (same code/kind + screen + message) collapse into one entry with a count.
+        findings: dedupeFindings(session.findings).map((f) => {
             const code = f.failureCode ?? failureForFindingKind(f.kind);
             const info = FAILURES[code] ?? FAILURES.UNKNOWN;
-            return { ...f, failureCode: code, bucket: info.bucket, retrySafe: info.retrySafe, nextStep: info.recovery, detail: redact(f.detail), evidence: f.evidence ? redact(f.evidence) : undefined };
+            return {
+                ...f,
+                failureCode: code,
+                bucket: info.bucket,
+                retrySafe: info.retrySafe,
+                nextStep: info.recovery,
+                detail: redact(f.detail),
+                evidence: f.evidence ? redact(f.evidence) : undefined,
+            };
         }),
+        findingOccurrences: session.findings.length,
+        toolErrors: toolErrors.slice(-50).map((t) => ({ ...t, message: redact(t.message) ?? t.message })),
         highSeverityCount: high.length,
         nativeHealth,
         appHealth,
-        appHealthFindings: appFindings.map((f) => ({ kind: f.kind, severity: f.severity, evidence: f.evidence ? redact(f.evidence) : undefined, screen: f.screen, screenshotUri: f.screenshotUri })),
+        appHealthFindings: appFindings.map((f) => ({
+            kind: f.kind,
+            severity: f.severity,
+            evidence: f.evidence ? redact(f.evidence) : undefined,
+            screen: f.screen,
+            screenshotUri: f.screenshotUri,
+        })),
         testOutcomes: notes.map((n) => ({ ...n, reason: n.reason ? redact(n.reason) : undefined })),
         outcomeTally,
         categoryTally,
@@ -367,7 +431,7 @@ export async function generateSessionReport(sessions, session, options = {}) {
         wda: wdaReport,
         ci: { env: !!process.env.CI },
         visualOnly: session.mode === 'visual-fallback',
-        // Generated suite (Phase 3.2.1): paths, compiled flows, runnable status — so the report (not
+        // Generated suite (Phase 3.2.1): paths, compiled flows, runnable status, so the report (not
         // just the job result) records whether a runnable automation suite was produced.
         generatedSuite: options.suite ?? null,
         // Guided exploration (Phase 3.3 §9.2): screen graph + coverage counts.
@@ -388,16 +452,36 @@ export async function generateSessionReport(sessions, session, options = {}) {
         artifacts: session.artifacts.map((art) => ({ uri: art.uri, kind: art.kind, mime: art.mime, label: art.label })),
         counters: session.counters,
     };
-    // Issue memory (SWIPIUM-REQ-07): fold this run's findings + app-bug outcomes into the durable
+    // Issue memory: fold this run's findings + app-bug outcomes into the durable
     // `.swipium/issues-log.jsonl`, reopen previously-fixed fingerprints, and attach the issue-memory
-    // section (+ recurrence markdown) to the report. Best-effort — the ledger never breaks a report.
+    // section (+ recurrence markdown) to the report. Best-effort: the ledger never breaks a report.
     try {
         const platform = driver instanceof WdaDriver ? 'ios' : driver ? 'android' : 'unknown';
         const environment = session.headless !== undefined ? (platform === 'ios' ? 'simulator' : 'emulator') : process.env.CI ? 'ci' : 'unknown';
         const issuePolicy = loadIssuePolicy(session.root);
-        const sourceRevision = resolveSourceRevision({ env: process.env, allowGitMetadataRead: issuePolicy.allowGitMetadataRead, root: session.root });
-        const bridgeFindings = session.findings.map((f) => ({ severity: f.severity, kind: f.kind, detail: redact(f.detail) ?? f.detail, layer: f.layer, evidence: f.evidence ? redact(f.evidence) : undefined, screen: f.screen, screenshotUri: f.screenshotUri, failureCode: f.failureCode }));
-        const bridgeNotes = notes.map((n) => ({ workflow: n.workflow, outcome: n.outcome, category: n.category, reason: n.reason ? redact(n.reason) : undefined, failureCode: n.failureCode, artifactUris: n.artifactUris }));
+        const sourceRevision = resolveSourceRevision({
+            env: process.env,
+            allowGitMetadataRead: issuePolicy.allowGitMetadataRead,
+            root: session.root,
+        });
+        const bridgeFindings = session.findings.map((f) => ({
+            severity: f.severity,
+            kind: f.kind,
+            detail: redact(f.detail) ?? f.detail,
+            layer: f.layer,
+            evidence: f.evidence ? redact(f.evidence) : undefined,
+            screen: f.screen,
+            screenshotUri: f.screenshotUri,
+            failureCode: f.failureCode,
+        }));
+        const bridgeNotes = notes.map((n) => ({
+            workflow: n.workflow,
+            outcome: n.outcome,
+            category: n.category,
+            reason: n.reason ? redact(n.reason) : undefined,
+            failureCode: n.failureCode,
+            artifactUris: n.artifactUris,
+        }));
         const issuesNow = new Date().toISOString();
         const bridge = foldRunIntoLedger(session.root, bridgeFindings, bridgeNotes, issuesNow, {
             appId: appId ?? undefined,
@@ -407,14 +491,16 @@ export async function generateSessionReport(sessions, session, options = {}) {
             sourceRevision,
         });
         // Link recorded issues to persistent test cases, and verify fixed issues that a PASSING case
-        // covers this run (REQ-08). The case→workflow key is the workflow string the suite generator
+        // covers this run. The case > workflow key is the workflow string the suite generator
         // folds into actualResult.summary.
         let verifiedFixedIds = new Set();
         if (mergedSuite) {
             const idx = getIssueIndex(session.root, issuesNow, appId ?? undefined);
             const recordById = new Map(idx.records.map((r) => [r.issueId, r]));
             const matchCase = (workflow) => workflow
-                ? mergedSuite.cases.filter((c) => c.actualResult.summary?.toLowerCase().includes(workflow.toLowerCase()) || c.functionality.toLowerCase() === workflow.toLowerCase() || c.title.toLowerCase().includes(workflow.toLowerCase()))
+                ? mergedSuite.cases.filter((c) => c.actualResult.summary?.toLowerCase().includes(workflow.toLowerCase()) ||
+                    c.functionality.toLowerCase() === workflow.toLowerCase() ||
+                    c.title.toLowerCase().includes(workflow.toLowerCase()))
                 : [];
             for (const rec of bridge.recorded) {
                 const record = recordById.get(rec.issueId);
@@ -441,14 +527,14 @@ export async function generateSessionReport(sessions, session, options = {}) {
             verifiedFixedIds = new Set(verified);
             saveSuite(session.root, mergedSuite);
         }
-        // Rebuild the section honoring verified-fixed evidence (REQ-08 honest fix verification).
+        // Rebuild the section honoring verified-fixed evidence (honest fix verification).
         const finalIdx = getIssueIndex(session.root, issuesNow, appId ?? undefined);
         const finalSection = buildReportIssuesSection(finalIdx.records, new Set(bridge.recordedIssueIds), verifiedFixedIds);
         report.issues = finalSection;
         report.issuesMarkdown = issuesSectionToMarkdown(finalSection);
         if (bridge.recurrences.length)
             report.issueRecurrences = bridge.recurrences;
-        // Compact quality metrics when enough history exists (REQ-08): this run's new/reopened/verified
+        // Compact quality metrics when enough history exists: this run's new/reopened/verified
         // counts + open blocker/high totals + reopen/fix-verification rates.
         const allEvents = readIssueEvents(session.root);
         if (allEvents.length >= 2) {
@@ -464,15 +550,24 @@ export async function generateSessionReport(sessions, session, options = {}) {
                 avgAgeDays: metrics.avgAgeDays,
             };
         }
-        // Refresh app-map issue summaries from the freshly-updated ledger (REQ-08) — only when a map
-        // already exists, and WITHOUT a static rescan (runtime_merge load → apply summaries → save).
+        // Refresh app-map issue summaries from the freshly-updated ledger, only when a map
+        // already exists, and WITHOUT a static rescan (runtime_merge load > apply summaries > save).
         if (existsSync(appMapPath(session.root))) {
             buildAppMap(session.root, { mode: 'runtime_merge', at: issuesNow, includeCodeIndex: false, persist: true });
         }
     }
     catch {
-        /* best-effort — issue ledger is additive, never blocks the report */
+        /* best-effort: issue ledger is additive, never blocks the report */
     }
+    // B9: deep-redact the WHOLE report (steps, nextStep, missingPrecondition, workflow names, issue
+    // markdown, …) with the session redactor before it is persisted or rendered into any export.
+    // Escaping in JUnit/SARIF/Markdown would otherwise turn a secret into text redaction can't match.
+    // Replace the fields rather than merge: a top-level key that itself redacts to a different
+    // spelling must not survive in its raw form next to the redacted copy.
+    const redactedReport = redactReportData(report, redact);
+    for (const k of Object.keys(report))
+        delete report[k];
+    Object.assign(report, redactedReport);
     const prSummary = { text: inlinePrSummary(report) };
     report.prSummary = prSummary;
     const reportUri = sessions.saveArtifact(session, 'report', `report-${Date.now()}.json`, JSON.stringify(report, null, 2), 'application/json');
@@ -481,12 +576,26 @@ export async function generateSessionReport(sessions, session, options = {}) {
     if ((baseline || trendRoot) && reportRec) {
         try {
             const pr = buildPrSummary(reportRec.path, { baselinePath: baseline, trendRoot: trendRoot ?? session.root });
-            reportLinks = { current: reportUri, currentPath: reportRec.path, baseline: baseline ?? null, trendRoot: trendRoot ?? session.root, comparison: pr.comparison ?? null, knownFlaky: pr.knownFlaky, prSummary: pr };
+            reportLinks = {
+                current: reportUri,
+                currentPath: reportRec.path,
+                baseline: baseline ?? null,
+                trendRoot: trendRoot ?? session.root,
+                comparison: pr.comparison ?? null,
+                knownFlaky: pr.knownFlaky,
+                prSummary: pr,
+            };
             report.reportLinks = reportLinks;
             writeFileSync(reportRec.path, JSON.stringify(report, null, 2));
         }
         catch (e) {
-            reportLinks = { current: reportUri, currentPath: reportRec.path, baseline: baseline ?? null, trendRoot: trendRoot ?? session.root, error: String(e.message ?? e) };
+            reportLinks = {
+                current: reportUri,
+                currentPath: reportRec.path,
+                baseline: baseline ?? null,
+                trendRoot: trendRoot ?? session.root,
+                error: String(e.message ?? e),
+            };
             report.reportLinks = reportLinks;
             writeFileSync(reportRec.path, JSON.stringify(report, null, 2));
         }
@@ -502,15 +611,49 @@ export async function generateSessionReport(sessions, session, options = {}) {
                 flowExportSkipped = true;
             }
             else {
-                const gen = generateFlow(session.recordedActions, { name: `${(appId ?? 'app').split('.').pop()}-recorded`, appId: appId ?? undefined });
+                const gen = generateFlow(session.recordedActions, {
+                    name: `${(appId ?? 'app').split('.').pop()}-recorded`,
+                    appId: appId ?? undefined,
+                    secrets: session.secrets,
+                    inputs: inputBindings(session),
+                });
                 exportUri = sessions.saveArtifact(session, 'flow', `recorded-${Date.now()}.yaml`, gen.yaml, 'text/yaml', `flow drafted from the run (durability ${gen.durability.grade})`);
             }
         }
         else {
             const data = report;
-            const body = format === 'markdown' ? toMarkdown(data) : format === 'playwright' ? toPlaywrightJson(data) : toJUnit(data);
-            const ext = format === 'markdown' ? 'md' : format === 'playwright' ? 'playwright.json' : 'xml';
-            const mime = format === 'markdown' ? 'text/markdown' : format === 'playwright' ? 'application/json' : 'application/xml';
+            // CI formats (junit/sarif/github-summary) carry a release-gate verdict: map the report's
+            // failures onto policy FlowVerdicts, then let .swipium/policy.json (blockOn/warnOn/
+            // ignoreKnown) decide pass/fail. With no policy file, ANY failure blocks (applyPolicy).
+            const ciFormat = format === 'junit' || format === 'sarif' || format === 'github-summary';
+            const policy = ciFormat
+                ? applyPolicy(reportPolicyVerdicts(data), loadReleasePolicy(session.root))
+                : undefined;
+            const body = format === 'markdown'
+                ? toMarkdown(data)
+                : format === 'playwright'
+                    ? toPlaywrightJson(data)
+                    : format === 'sarif'
+                        ? toSarif(data, policy, { sources: resolveSarifSources(session.root, data) })
+                        : format === 'github-summary'
+                            ? toGithubSummary(data, policy)
+                            : toJUnit(data, policy);
+            const ext = format === 'markdown'
+                ? 'md'
+                : format === 'playwright'
+                    ? 'playwright.json'
+                    : format === 'sarif'
+                        ? 'sarif.json'
+                        : format === 'github-summary'
+                            ? 'summary.md'
+                            : 'xml';
+            const mime = format === 'markdown' || format === 'github-summary'
+                ? 'text/markdown'
+                : format === 'playwright'
+                    ? 'application/json'
+                    : format === 'sarif'
+                        ? 'application/sarif+json'
+                        : 'application/xml';
             exportUri = sessions.saveArtifact(session, 'report', `report-${Date.now()}.${ext}`, body, mime);
         }
     }
@@ -518,55 +661,92 @@ export async function generateSessionReport(sessions, session, options = {}) {
     const manifestUri = sessions.saveArtifact(session, 'manifest', `manifest-${Date.now()}.json`, JSON.stringify(manifest, null, 2), 'application/json', 'artifact manifest with SHA-256 hashes');
     const noteSummaryLines = notes.map((n) => {
         const ev = evidenceByWorkflow.get(n.workflow);
-        return `  • ${n.workflow}: ${n.outcome}${ev ? ` (evidence=${ev.kind}/${ev.authority})` : ''}${n.category ? ` [${n.category}]` : ''}${n.missingPrecondition ? ` — missing: ${n.missingPrecondition}` : n.reason ? ` — ${redact(n.reason)}` : ''}${n.recommendedSetup ? ` · setup: ${n.recommendedSetup}` : ''}`;
+        return `  • ${n.workflow}: ${n.outcome}${ev ? ` (evidence=${ev.kind}/${ev.authority})` : ''}${n.category ? ` [${n.category}]` : ''}${n.missingPrecondition ? ` (missing: ${n.missingPrecondition})` : n.reason ? `: ${redact(n.reason)}` : ''}${n.recommendedSetup ? ` · setup: ${n.recommendedSetup}` : ''}`;
     });
     const lines = [
-        `Report for ${session.id} — app=${report.appId} device=${report.device}`,
-        `RELEASE RISK: ${executiveSummary.risk.toUpperCase()} — ${executiveSummary.nextAction}`,
+        `Report for ${session.id}: app=${report.appId} device=${report.device}`,
+        `RELEASE RISK: ${executiveSummary.risk.toUpperCase()}: ${executiveSummary.nextAction}`,
         `App status: ${appVerdict.status} - ${appVerdict.summary}`,
         `Coverage status: ${coverageVerdict.status} - ${coverageVerdict.summary}`,
         `Tool status: ${toolVerdict.status} - ${toolVerdict.summary}`,
         `PR summary:\n${prSummary.text}`,
         `backend: ${report.automationBackend.description} (${report.automationBackend.mode})`,
-        `QA level: ${qaLevel.level.toUpperCase()} — ${qaLevel.rationale}${qaLevel.next ? ` · next: ${qaLevel.next} (${qaLevel.nextRequirement})` : ''}`,
+        `QA level: ${qaLevel.level.toUpperCase()}: ${qaLevel.rationale}${qaLevel.next ? ` · next: ${qaLevel.next} (${qaLevel.nextRequirement})` : ''}`,
         qaLevel.notes.length ? `QA level notes:\n  ${qaLevel.notes.join('\n  ')}` : '',
         `automation readiness: ${automationReadiness.grade} (${automationReadiness.score}/100, durable locators ${automationReadiness.locatorCoverage.durablePct}%)`,
-        `test catalog: ${runTestCatalog.total} case(s) — ${Object.entries(runTestCatalog.counts).filter(([, v]) => v).map(([k, v]) => `${k}=${v}`).join(' ') || 'none'}`,
-        automationReadiness.topFixes.length ? `top readiness fixes:\n  ${automationReadiness.topFixes.join('\n  ')}` : 'top readiness fixes: none',
-        `${report.coverage}${report.visualOnly ? ' · VISUAL-ONLY (structured snapshots were poor — see screenshots)' : ''}`,
+        `test catalog: ${runTestCatalog.total} case(s): ${Object.entries(runTestCatalog.counts)
+            .filter(([, v]) => v)
+            .map(([k, v]) => `${k}=${v}`)
+            .join(' ') || 'none'}`,
+        automationReadiness.topFixes.length
+            ? `top readiness fixes:\n  ${automationReadiness.topFixes.join('\n  ')}`
+            : 'top readiness fixes: none',
+        `${report.coverage}${report.visualOnly ? ' · VISUAL-ONLY (structured snapshots were poor, see screenshots)' : ''}`,
         `emulator display: ${report.emulatorDisplay}`,
         `network: ${finalNetwork}${networkRestore ? ` (${networkRestore})` : session.network?.changed ? ' ⚠ Swipium changed it and did NOT restore' : ''}`,
-        report.activeRecording ? `A screen recording is still active (${report.activeRecording.backend}, ~${report.activeRecording.seconds}s). It will be stopped on shutdown.` : '',
+        report.activeRecording
+            ? `A screen recording is still active (${report.activeRecording.backend}, ~${report.activeRecording.seconds}s). It will be stopped on shutdown.`
+            : '',
         session.envChanges.length ? `environment changes:\n  ${session.envChanges.join('\n  ')}` : 'environment changes: none',
-        session.mutations.length ? `mutation ledger: ${session.mutations.length} record(s), ${session.mutations.filter((m) => m.status === 'executed').length} executed, ${session.mutations.filter((m) => m.status === 'refused' || m.status === 'blocked').length} refused/blocked` : 'mutation ledger: none',
-        report.guardrailOverrides.length ? `⚠ guardrail overrides used:\n  ${report.guardrailOverrides.join('\n  ')}` : 'guardrail overrides: none',
+        session.mutations.length
+            ? `mutation ledger: ${session.mutations.length} record(s), ${session.mutations.filter((m) => m.status === 'executed').length} executed, ${session.mutations.filter((m) => m.status === 'refused' || m.status === 'blocked').length} refused/blocked`
+            : 'mutation ledger: none',
+        report.guardrailOverrides.length
+            ? `⚠ guardrail overrides used:\n  ${report.guardrailOverrides.join('\n  ')}`
+            : 'guardrail overrides: none',
         session.workarounds.length ? `workarounds attempted:\n  ${session.workarounds.join('\n  ')}` : '',
-        session.inputs.length ? `inputs provided (redacted): ${session.inputs.map((i) => `${i.varName}${i.secret ? '🔒' : ''}`).join(', ')}` : '',
-        session.generatedValues.length ? `generated test data: ${session.generatedValues.map((g) => `${g.fixture}.${g.field}=${g.secret ? '<redacted>' : redact(g.value)} (${g.generator})`).join(', ')}` : '',
+        session.inputs.length
+            ? `inputs provided (redacted): ${session.inputs.map((i) => `${i.varName}${i.secret ? '🔒' : ''}`).join(', ')}`
+            : '',
+        session.redactionDegraded
+            ? '⚠ redaction degraded: this session was restored after a server restart. Secrets registered before the restart are no longer in the redaction set, so artifacts written since may contain those values unredacted'
+            : '',
+        session.generatedValues.length
+            ? `generated test data: ${session.generatedValues.map((g) => `${g.fixture}.${g.field}=${g.secret ? '<redacted>' : redact(g.value)} (${g.generator})`).join(', ')}`
+            : '',
         options.suite
             ? options.suite.generated
-                ? `generated suite "${options.suite.name}": ${(options.suite.compiledFlows ?? []).filter((c) => c.ok).length}/${(options.suite.compiledFlows ?? []).length} runnable flow(s), runnable=${options.suite.suiteRunnable}, readiness=${(options.suite.readinessLabels ?? []).join(' → ') || 'unknown'} (${(options.suite.written ?? []).length} files)`
+                ? `generated suite "${options.suite.name}": ${(options.suite.compiledFlows ?? []).filter((c) => c.ok).length}/${(options.suite.compiledFlows ?? []).length} runnable flow(s), runnable=${options.suite.suiteRunnable}, readiness=${(options.suite.readinessLabels ?? []).join(' > ') || 'unknown'} (${(options.suite.written ?? []).length} files)`
                 : `suite generation skipped: ${options.suite.skippedReason}`
             : '',
         session.exploration
             ? `exploration: ${session.exploration.summary.screensVisited} screens, ${session.exploration.summary.workflowsFound} transitions, ${session.exploration.summary.visualOnlyScreens} visual-only, ${session.exploration.summary.unsafeActionsSkipped} unsafe skipped, ${session.exploration.summary.appErrors} app errors (graph: ${session.exploration.graphUri})`
             : '',
         `destructive/bundle-risk guardrail: ${destructiveGuardrail.status}`,
-        `health — native: ${nativeHealth === 'OK' ? '✅ OK' : '❌ error'} · app: ${appHealth === 'OK' ? '✅ OK' : appHealth === 'degraded' ? '⚠ degraded' : '❌ error'}`,
-        wdaReport ? `wda: ${wdaReport.status.reachable ? 'reachable' : 'unreachable'} ${wdaReport.webDriverAgentUrl} device=${wdaReport.device ?? 'unknown'}` : '',
-        `findings: ${session.findings.length} (high: ${high.length})`,
-        totalFailures ? `failures by bucket: ${ALL_BUCKETS.filter((b) => bucketCounts[b]).map((b) => `${b}=${bucketCounts[b]}`).join(' ')} (${failureBuckets.classifiedPct}% classified${dominantBucket ? `, mostly ${dominantBucket}` : ''})` : '',
-        notes.length ? `evidence taxonomy: structured=${evidenceTaxonomy.counts.structured_locator} ocr=${evidenceTaxonomy.counts.ocr_locator} visual=${evidenceTaxonomy.counts.visual_match} ai_visual=${evidenceTaxonomy.counts.ai_visual_evidence} manual=${evidenceTaxonomy.counts.manual_review} calibration=${evidenceTaxonomy.calibration.status}` : '',
-        ...session.findings.map((f) => `  [${f.severity}] ${f.layer ?? '?'}/${f.kind}: ${redact(f.detail)}${f.evidence ? ` — "${redact(f.evidence)}"` : ''}${f.screenshotUri ? ` (${f.screenshotUri})` : ''}`),
-        notes.length ? `test outcomes: ${Object.entries(outcomeTally).map(([k, v]) => `${k}=${v}`).join(' ')}` : 'test outcomes: none recorded (qa_note)',
+        `health: native: ${nativeHealth === 'OK' ? '✅ OK' : '❌ error'} · app: ${appHealth === 'OK' ? '✅ OK' : appHealth === 'degraded' ? '⚠ degraded' : '❌ error'}`,
+        wdaReport
+            ? `wda: ${wdaReport.status.reachable ? 'reachable' : 'unreachable'} ${wdaReport.webDriverAgentUrl} device=${wdaReport.device ?? 'unknown'}`
+            : '',
+        `findings: ${uniqueFindings.length} unique (${session.findings.length} occurrence(s), high: ${high.length})`,
+        toolErrors.length
+            ? `tool errors: ${toolVerdict.toolErrorCount}: ${Object.entries(toolVerdict.toolErrorsByCode)
+                .map(([c, n]) => `${c}×${n}`)
+                .join(', ')}`
+            : '',
+        totalFailures
+            ? `failures by bucket: ${ALL_BUCKETS.filter((b) => bucketCounts[b])
+                .map((b) => `${b}=${bucketCounts[b]}`)
+                .join(' ')} (${failureBuckets.classifiedPct}% classified${dominantBucket ? `, mostly ${dominantBucket}` : ''})`
+            : '',
+        notes.length
+            ? `evidence taxonomy: structured=${evidenceTaxonomy.counts.structured_locator} ocr=${evidenceTaxonomy.counts.ocr_locator} visual=${evidenceTaxonomy.counts.visual_match} ai_visual=${evidenceTaxonomy.counts.ai_visual_evidence} manual=${evidenceTaxonomy.counts.manual_review} calibration=${evidenceTaxonomy.calibration.status}`
+            : '',
+        ...uniqueFindings.map((f) => `  [${f.severity}] ${f.layer ?? '?'}/${f.kind}: ${redact(f.detail)}${f.evidence ? `: "${redact(f.evidence)}"` : ''}${f.screenshotUri ? ` (${f.screenshotUri})` : ''}${repeatSuffix(f)}`),
+        notes.length
+            ? `test outcomes: ${Object.entries(outcomeTally)
+                .map(([k, v]) => `${k}=${v}`)
+                .join(' ')}`
+            : 'test outcomes: none recorded (qa_note)',
         ...noteSummaryLines,
         persistentSuite
-            ? `persistent suite: ${persistentSuite.totalCases} case(s) — +${persistentSuite.created.length} created, ~${persistentSuite.updated.length} updated, -${persistentSuite.deprecated.length} deprecated, ${persistentSuite.failed.length} failed, ${persistentSuite.blocked.length} blocked, ${persistentSuite.newlyAutomated.length} newly automated`
+            ? `persistent suite: ${persistentSuite.totalCases} case(s): +${persistentSuite.created.length} created, ~${persistentSuite.updated.length} updated, -${persistentSuite.deprecated.length} deprecated, ${persistentSuite.failed.length} failed, ${persistentSuite.blocked.length} blocked, ${persistentSuite.newlyAutomated.length} newly automated`
             : '',
         `auth: ${authState}`,
         session.fixtures.length ? `declared preconditions: ${session.fixtures.map((f) => f.name).join(', ')}` : '',
-        `timing: total=${phaseTimings.totalSec}s setup=${phaseTimings.setupSec}s active=${phaseTimings.activeSec}s${phaseTimings.timeToLoginSec != null ? ` toLogin=${phaseTimings.timeToLoginSec}s` : ''}${phaseTimings.diagnostics.waitSec != null ? ` wait=${phaseTimings.diagnostics.waitSec}s` : ''}${phaseTimings.diagnostics.flowRuntimeSec != null ? ` flows=${phaseTimings.diagnostics.flowRuntimeSec}s` : ''}${session.budgetProfile ? ` (profile=${session.budgetProfile})` : ''}`,
-        reportLinks ? `report links: baseline=${baseline ?? 'none'} trend=${trendRoot ?? session.root}${typeof reportLinks.comparison === 'string' ? ` comparison=${reportLinks.comparison}` : ''}` : '',
+        `timing: total=${secText(phaseTimings.totalMs)} setup=${secText(phaseTimings.setupMs)} active=${secText(phaseTimings.activeMs)}${phaseTimings.timeToLoginMs != null ? ` toLogin=${secText(phaseTimings.timeToLoginMs)}` : ''}${phaseTimings.diagnostics.waitMs != null ? ` wait=${secText(phaseTimings.diagnostics.waitMs)}` : ''}${phaseTimings.diagnostics.flowRuntimeMs != null ? ` flows=${secText(phaseTimings.diagnostics.flowRuntimeMs)}` : ''}${session.budgetProfile ? ` (profile=${session.budgetProfile})` : ''}`,
+        reportLinks
+            ? `report links: baseline=${baseline ?? 'none'} trend=${trendRoot ?? session.root}${typeof reportLinks.comparison === 'string' ? ` comparison=${reportLinks.comparison}` : ''}`
+            : '',
         `artifacts: ${session.artifacts.length} (${screenshots.length} screenshots)`,
         ...session.artifacts.map((art) => `  ${art.uri} (${art.kind}${art.label ? `: ${art.label}` : ''})`),
         dumpUri ? `current dump: ${dumpUri}` : '',
@@ -574,6 +754,17 @@ export async function generateSessionReport(sessions, session, options = {}) {
         `manifest: ${manifestUri}`,
         exportUri && exportUri !== reportUri ? `${format} export: ${exportUri}` : '',
     ].filter(Boolean);
-    return { report, reportUri, manifestUri, manifest, dumpUri, reportLinks, exportUri, exportFormat: exportUri ? format : undefined, summaryText: lines.join('\n'), flowExportSkipped };
+    return {
+        report,
+        reportUri,
+        manifestUri,
+        manifest,
+        dumpUri,
+        reportLinks,
+        exportUri,
+        exportFormat: exportUri ? format : undefined,
+        summaryText: redact(lines.join('\n')) ?? '',
+        flowExportSkipped,
+    };
 }
 //# sourceMappingURL=report.js.map