sanityops-cli 0.1.5__tar.gz → 0.1.7__tar.gz

{sanityops_cli-0.1.5 → sanityops_cli-0.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sanityops-cli
-Version: 0.1.5
+Version: 0.1.7
 Summary: CLI tool for static defect inspection of AI logical artifacts
 Project-URL: Homepage, https://sanityops.org
 Project-URL: Documentation, https://sanityops.org
@@ -23,7 +23,7 @@ Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
 Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: >=3.11
 Requires-Dist: anyio>=4.0
-Requires-Dist: defect-check
+Requires-Dist: defect-check>=0.0.1
 Requires-Dist: httpx>=0.27
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: rich>=13.0
@@ -48,9 +48,15 @@ A command-line tool for static defect inspection of AI logical artifacts (System
 
 - **Multi-level inspection depth** — Choose between L1 (fast), L2 (standard), or L3 (deep) check levels
 - **Multiple artifact types** — Inspect System Prompts, Skills, and Tool Schemas
-- **CI/CD ready** — Designed for automated pipeline integration
+- **CI/CD friendly** — Non-interactive runs, configuration via environment variables, dated markdown reports for pipeline artifacts
 - **Configurable rules** — Customize inspection behavior via YAML configuration
 
+## Prerequisites
+
+- **Python >= 3.11** — only needed when installing from PyPI or source; the curl/PowerShell installers ship a standalone binary with no Python requirement.
+- **An LLM API key** — artifact analysis and defect checking are LLM-powered. Use Anthropic, OpenAI, or any compatible provider, configured either in the `model:` section of the config file or via `LLM_*` environment variables (see [Environment Variables](#environment-variables)).
+- **Optional: a Sanityops server API key** — only if you want scanned artifacts uploaded to the Sanityops web dashboard. See [Data Handling](#data-handling) before enabling this.
+
 ## Installation
 
 ### From Curl (Recommended)
@@ -99,9 +105,9 @@ pip install -e .
 sanityops-cli init
 ```
 
-This creates `.sanityops/inspect_config.yaml` in your current directory with a
-freshly generated project UUID. The generated file matches the template below —
-edit the artifact paths to point at your prompts, tools, and skills.
+This creates `.sanityops/inspect_config.yaml` in your current directory from the built-in template. The `project.id` starts as a placeholder UUID (`00000000-0000-0000-0000-000000000000`); on the first `inspect` run with a server API key configured, the project is created on the Sanityops server and the real id/name are written back to this file. `init` also writes a `.gitignore` inside `.sanityops/` so the config file (which may hold API keys) and scan results never get committed.
+
+Edit the artifact paths to point at your prompts, tools, and skills.
 
 ### 2. Configure Artifacts
 
@@ -109,7 +115,10 @@ Edit `.sanityops/inspect_config.yaml` to specify your artifacts:
 
 ```yaml
 project:
-  id: <your-project-id>          # required: UUID
+  # id starts as a placeholder; on the first inspect run with a server API key,
+  # the project is created automatically and the real id/name are written back.
+  id: 00000000-0000-0000-0000-000000000000
+  name: ""
 
 # Optional: omit to use LLM_* environment variables
 # model:
@@ -147,6 +156,10 @@ sanityops-cli inspect --skip-defect-check
 sanityops-cli inspect --config path/to/config.yaml
 ```
 
+> **Data upload notice:** if a Sanityops server API key is configured (`server.api_key` or `SANITYOPS_API_KEY`), `inspect` automatically uploads the scanned artifacts to the Sanityops server after analysis. Without an API key, everything stays on your machine. See [Data Handling](#data-handling).
+
+`inspect` exits `0` when the run completes — including when defects are found — and non-zero on failure. CI pipelines should therefore gate on the generated report (`.sanityops/results/inspect-*.md`), not on the exit code.
+
 ### 4. Generate Repairs (Optional)
 
 After inspection, generate repaired artifacts from the report:
@@ -164,6 +177,20 @@ sanityops-cli inspect repair --timeout 3600 --token-budget 500000
 
 Repairs are written to `.sanityops/repairs/repair-<timestamp>.md` without modifying source files.
 
+## Data Handling
+
+What leaves your machine, and when:
+
+- **Local by default.** Artifact analysis and defect checking run on your machine and send artifact content only to the LLM provider you configure (`model:` section or `LLM_*` environment variables). Without a Sanityops server API key, nothing is uploaded to the Sanityops server.
+- **Auto-upload is keyed to the server API key.** If `server.api_key` (or `SANITYOPS_API_KEY`) is set, `inspect` uploads the scanned artifacts — System Prompts, Tool Schemas, Skills — to the Sanityops server after analysis, so they appear in the web dashboard. The first such run also creates the project on the server and binds `project.id`.
+- **Server destination.** `server.base_url` defaults to the Sanityops SaaS service (`https://demo.sanityops.org`). Only change it if you run a private deployment:
+
+  ```bash
+  sanityops-cli config server.base_url https://api.your-deployment.com
+  ```
+
+- **Secrets are protected locally.** API keys are masked in CLI output and redacted from logs, and the `.sanityops/` directory is excluded from git by the `.gitignore` that `init` writes.
+
 ## Configuration
 
 ### Config Command
@@ -190,6 +217,8 @@ sanityops-cli config --list
 sanityops-cli config --unset server.base_url
 ```
 
+`server.base_url` defaults to the Sanityops SaaS service (`https://demo.sanityops.org`). Change it only if you use a private deployment.
+
 ### Configuration Precedence
 
 Values are resolved in this priority order (highest to lowest):
@@ -205,8 +234,8 @@ This ordering ensures CI/CD pipelines can override any project config by injecti
 
 | Variable | Description |
 |----------|-------------|
-| `SANITYOPS_BASE_URL` | Override `server.base_url` |
-| `SANITYOPS_API_KEY` | Override `server.api_key` |
+| `SANITYOPS_BASE_URL` | Override `server.base_url` (default: `https://demo.sanityops.org`) |
+| `SANITYOPS_API_KEY` | Override `server.api_key`; when set, `inspect` auto-uploads artifacts to the server |
 | `LLM_PROVIDER` | LLM provider (e.g., `anthropic`, `openai`) |
 | `LLM_API_KEY` | LLM API key for defect checking |
 | `LLM_MODEL_ID` | LLM model ID (e.g., `claude-sonnet-4-20250514`) |
@@ -243,11 +272,6 @@ All CLI operations are logged to `~/.sanityops/logs/sanityops-cli-<YYYY-MM-DD>.l
 
 Full documentation is available at [sanityops.org](https://sanityops.org).
 
-## Requirements
-
-- Python >= 3.11
-- OpenAI API key (or compatible LLM provider) for defect checking
-
 ## Development
 
 ### Setup

{sanityops_cli-0.1.5 → sanityops_cli-0.1.7}/README.md

@@ -8,9 +8,15 @@ A command-line tool for static defect inspection of AI logical artifacts (System
 
 - **Multi-level inspection depth** — Choose between L1 (fast), L2 (standard), or L3 (deep) check levels
 - **Multiple artifact types** — Inspect System Prompts, Skills, and Tool Schemas
-- **CI/CD ready** — Designed for automated pipeline integration
+- **CI/CD friendly** — Non-interactive runs, configuration via environment variables, dated markdown reports for pipeline artifacts
 - **Configurable rules** — Customize inspection behavior via YAML configuration
 
+## Prerequisites
+
+- **Python >= 3.11** — only needed when installing from PyPI or source; the curl/PowerShell installers ship a standalone binary with no Python requirement.
+- **An LLM API key** — artifact analysis and defect checking are LLM-powered. Use Anthropic, OpenAI, or any compatible provider, configured either in the `model:` section of the config file or via `LLM_*` environment variables (see [Environment Variables](#environment-variables)).
+- **Optional: a Sanityops server API key** — only if you want scanned artifacts uploaded to the Sanityops web dashboard. See [Data Handling](#data-handling) before enabling this.
+
 ## Installation
 
 ### From Curl (Recommended)
@@ -59,9 +65,9 @@ pip install -e .
 sanityops-cli init
 ```
 
-This creates `.sanityops/inspect_config.yaml` in your current directory with a
-freshly generated project UUID. The generated file matches the template below —
-edit the artifact paths to point at your prompts, tools, and skills.
+This creates `.sanityops/inspect_config.yaml` in your current directory from the built-in template. The `project.id` starts as a placeholder UUID (`00000000-0000-0000-0000-000000000000`); on the first `inspect` run with a server API key configured, the project is created on the Sanityops server and the real id/name are written back to this file. `init` also writes a `.gitignore` inside `.sanityops/` so the config file (which may hold API keys) and scan results never get committed.
+
+Edit the artifact paths to point at your prompts, tools, and skills.
 
 ### 2. Configure Artifacts
 
@@ -69,7 +75,10 @@ Edit `.sanityops/inspect_config.yaml` to specify your artifacts:
 
 ```yaml
 project:
-  id: <your-project-id>          # required: UUID
+  # id starts as a placeholder; on the first inspect run with a server API key,
+  # the project is created automatically and the real id/name are written back.
+  id: 00000000-0000-0000-0000-000000000000
+  name: ""
 
 # Optional: omit to use LLM_* environment variables
 # model:
@@ -107,6 +116,10 @@ sanityops-cli inspect --skip-defect-check
 sanityops-cli inspect --config path/to/config.yaml
 ```
 
+> **Data upload notice:** if a Sanityops server API key is configured (`server.api_key` or `SANITYOPS_API_KEY`), `inspect` automatically uploads the scanned artifacts to the Sanityops server after analysis. Without an API key, everything stays on your machine. See [Data Handling](#data-handling).
+
+`inspect` exits `0` when the run completes — including when defects are found — and non-zero on failure. CI pipelines should therefore gate on the generated report (`.sanityops/results/inspect-*.md`), not on the exit code.
+
 ### 4. Generate Repairs (Optional)
 
 After inspection, generate repaired artifacts from the report:
@@ -124,6 +137,20 @@ sanityops-cli inspect repair --timeout 3600 --token-budget 500000
 
 Repairs are written to `.sanityops/repairs/repair-<timestamp>.md` without modifying source files.
 
+## Data Handling
+
+What leaves your machine, and when:
+
+- **Local by default.** Artifact analysis and defect checking run on your machine and send artifact content only to the LLM provider you configure (`model:` section or `LLM_*` environment variables). Without a Sanityops server API key, nothing is uploaded to the Sanityops server.
+- **Auto-upload is keyed to the server API key.** If `server.api_key` (or `SANITYOPS_API_KEY`) is set, `inspect` uploads the scanned artifacts — System Prompts, Tool Schemas, Skills — to the Sanityops server after analysis, so they appear in the web dashboard. The first such run also creates the project on the server and binds `project.id`.
+- **Server destination.** `server.base_url` defaults to the Sanityops SaaS service (`https://demo.sanityops.org`). Only change it if you run a private deployment:
+
+  ```bash
+  sanityops-cli config server.base_url https://api.your-deployment.com
+  ```
+
+- **Secrets are protected locally.** API keys are masked in CLI output and redacted from logs, and the `.sanityops/` directory is excluded from git by the `.gitignore` that `init` writes.
+
 ## Configuration
 
 ### Config Command
@@ -150,6 +177,8 @@ sanityops-cli config --list
 sanityops-cli config --unset server.base_url
 ```
 
+`server.base_url` defaults to the Sanityops SaaS service (`https://demo.sanityops.org`). Change it only if you use a private deployment.
+
 ### Configuration Precedence
 
 Values are resolved in this priority order (highest to lowest):
@@ -165,8 +194,8 @@ This ordering ensures CI/CD pipelines can override any project config by injecti
 
 | Variable | Description |
 |----------|-------------|
-| `SANITYOPS_BASE_URL` | Override `server.base_url` |
-| `SANITYOPS_API_KEY` | Override `server.api_key` |
+| `SANITYOPS_BASE_URL` | Override `server.base_url` (default: `https://demo.sanityops.org`) |
+| `SANITYOPS_API_KEY` | Override `server.api_key`; when set, `inspect` auto-uploads artifacts to the server |
 | `LLM_PROVIDER` | LLM provider (e.g., `anthropic`, `openai`) |
 | `LLM_API_KEY` | LLM API key for defect checking |
 | `LLM_MODEL_ID` | LLM model ID (e.g., `claude-sonnet-4-20250514`) |
@@ -203,11 +232,6 @@ All CLI operations are logged to `~/.sanityops/logs/sanityops-cli-<YYYY-MM-DD>.l
 
 Full documentation is available at [sanityops.org](https://sanityops.org).
 
-## Requirements
-
-- Python >= 3.11
-- OpenAI API key (or compatible LLM provider) for defect checking
-
 ## Development
 
 ### Setup

{sanityops_cli-0.1.5 → sanityops_cli-0.1.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sanityops-cli"
-version = "0.1.5"
+version = "0.1.7"
 description = "CLI tool for static defect inspection of AI logical artifacts"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -31,7 +31,7 @@ dependencies = [
     "httpx>=0.27",
     "tomli>=2.0",
     "tomli-w>=1.0",
-    "defect-check",
+    "defect-check>=0.0.1",
     "pyyaml>=6.0",
     "sanityops-agent>=0.0.4",
     "anyio>=4.0",

{sanityops_cli-0.1.5 → sanityops_cli-0.1.7}/src/sanityops_cli/__init__.py

@@ -13,4 +13,4 @@
 # limitations under the License.
 #
 
-__version__ = "0.1.5"
+__version__ = "0.1.7"

{sanityops_cli-0.1.5 → sanityops_cli-0.1.7}/src/sanityops_cli/agents/scanner_agent/agent.py

@@ -13,12 +13,21 @@
 # limitations under the License.
 #
 
+import re
 from pathlib import Path
 
 import anyio
+import yaml
 from rich.console import Console
 
-from sanityops_cli.agents.scanner_agent.models.finding import FindingsResult
+from sanityops_cli.agents.scanner_agent.models.finding import (
+    Finding,
+    FindingsResult,
+    FindingType,
+    PromptContent,
+    Section,
+    SkillContent,
+)
 from sanityops_cli.agents.scanner_agent.prompts import (
     # New analyzer prompts
     ANALYZE_PARENT_PROMPT,
@@ -239,7 +248,94 @@ class ScannerAgent:
                 error_msg += f"\nError Detail:\n{error_detail_str}"
             raise ValidationError(f"Agent execution failed: {error_msg}")
 
-        return self._build_result("", result)
+        findings_result = self._build_result("", result)
+
+        # Deterministic artifact capture: LLM transcription of prompt and
+        # skill files is lossy (random truncation/frontmatter loss), so
+        # replace the LLM's findings for those artifacts with content read
+        # verbatim from disk.
+        prompt_findings: list[Finding] = []
+        for prompt_path in prompts:
+            try:
+                content = Path(prompt_path).read_text(encoding="utf-8")
+            except (FileNotFoundError, PermissionError, UnicodeDecodeError, IsADirectoryError) as e:
+                raise ValidationError(f"Failed to read prompt file {prompt_path}: {e}") from e
+            prompt_findings.append(
+                Finding(
+                    type=FindingType.PROMPT,
+                    relative=prompt_path,  # Absolute path (validated upstream)
+                    content=PromptContent(content=content),
+                )
+            )
+        findings_result.prompts = prompt_findings
+
+        skill_findings: list[Finding] = []
+        for skill_path in skills:
+            try:
+                raw = Path(skill_path).read_text(encoding="utf-8")
+            except (FileNotFoundError, PermissionError, UnicodeDecodeError, IsADirectoryError) as e:
+                raise ValidationError(f"Failed to read skill file {skill_path}: {e}") from e
+
+            # Parse frontmatter: handle both standard format and EOF edge case
+            # Standard: "---\n<yaml>\n---\n<body>"
+            # EOF case: "---\n<yaml>\n---" (no trailing newline)
+            frontmatter: dict = {}
+            body = raw
+            if raw.startswith("---"):
+                # Try standard pattern first, then EOF pattern
+                match = re.match(r"^---\s*\n(.*?)\n---\s*\n?", raw, re.DOTALL)
+                if match:
+                    yaml_content = match.group(1)
+                    try:
+                        parsed = yaml.safe_load(yaml_content)
+                        if isinstance(parsed, dict):
+                            frontmatter = parsed
+                    except yaml.YAMLError as e:
+                        # Log warning but continue with empty frontmatter
+                        if self.logger:
+                            self.logger.warning(f"YAML parse error in {skill_path}: {e}")
+                        frontmatter = {}
+                    body = raw[match.end():]
+
+            sections: list[Section] = []
+            current_title = "Overview"
+            current_lines: list[str] = []
+            for line in body.split("\n"):
+                if line.startswith("## "):
+                    if current_lines:
+                        sections.append(
+                            Section(
+                                title=current_title,
+                                content="\n".join(current_lines).strip(),
+                            )
+                        )
+                    current_title = line[3:].strip()
+                    current_lines = []
+                else:
+                    current_lines.append(line)
+            if current_lines:
+                sections.append(
+                    Section(
+                        title=current_title,
+                        content="\n".join(current_lines).strip(),
+                    )
+                )
+
+            skill_findings.append(
+                Finding(
+                    type=FindingType.SKILL,
+                    relative=skill_path,  # Absolute path (validated upstream)
+                    content=SkillContent(
+                        name=str(frontmatter.get("name", "")),
+                        description=str(frontmatter.get("description", "")),
+                        frontmatter=frontmatter,
+                        sections=sections,
+                    ),
+                )
+            )
+        findings_result.skills = skill_findings
+
+        return findings_result
 
     def analyze_files_sync(
         self,

{sanityops_cli-0.1.5 → sanityops_cli-0.1.7}/src/sanityops_cli/agents/scanner_agent/models/finding.py

@@ -18,6 +18,7 @@ from enum import StrEnum
 from pathlib import Path
 from typing import Any
 
+import yaml
 from pydantic import BaseModel, Field, ValidationInfo, field_validator, model_validator
 
 
@@ -41,22 +42,70 @@ class ToolSchema(BaseModel):
 
 class SkillContent(BaseModel):
     """Extracted content from a skill.md file."""
+
     name: str = Field(description="Skill name from frontmatter")
     description: str = Field(description="Skill description from frontmatter")
+    frontmatter: dict[str, Any] = Field(
+        default_factory=dict,
+        description="Raw YAML frontmatter fields (preserved for QDS-0 gate)",
+    )
     sections: list[Section] = Field(default_factory=list, description="Parsed markdown sections")
 
+    #: Frontmatter fields that must be positive integers (QDS-0.4). LLM-based
+    #: extraction can stringify numeric values, so coerce them back to int.
+    _POSITIVE_INT_FIELDS: tuple[str, ...] = (
+        "max_items", "max_chars", "timeout_seconds", "max_tool_calls", "max_retries",
+    )
+
+    @model_validator(mode="after")
+    def _normalize_frontmatter_types(self) -> "SkillContent":
+        # Create a normalized copy to avoid in-place mutation
+        normalized = dict(self.frontmatter)
+        for field_name in self._POSITIVE_INT_FIELDS:
+            value = normalized.get(field_name)
+            if isinstance(value, str) and value.strip().isdigit():
+                normalized[field_name] = int(value.strip())
+            elif isinstance(value, float) and not isinstance(value, bool):
+                # YAML may parse integers as floats (e.g., "5" -> 5.0)
+                normalized[field_name] = int(value)
+            elif isinstance(value, bool):
+                # bool is a subclass of int; reject explicit true/false for int fields
+                normalized.pop(field_name, None)
+            # int values are already correct, no conversion needed
+        boolean_fields = ("partial_result_allowed",)
+        for field_name in boolean_fields:
+            value = normalized.get(field_name)
+            if isinstance(value, str):
+                lowered = value.strip().lower()
+                if lowered in ("true", "false"):
+                    normalized[field_name] = lowered == "true"
+        self.frontmatter = normalized
+        return self
+
     def to_markdown(self) -> str:
-        """Reconstruct sections back to markdown string.
+        """Reconstruct the full skill document: frontmatter plus sections.
 
-        Returns:
-            Markdown string with all sections joined by double newlines.
+        The frontmatter is re-serialized ahead of the body so downstream
+        consumers (e.g. the QDS-0 gate) can re-parse the declared metadata.
         """
+        parts: list[str] = []
+        if self.frontmatter:
+            # yaml is imported at module level; safe_dump preserves frontmatter.
+            parts.append(
+                "---\n"
+                + yaml.safe_dump(self.frontmatter, sort_keys=False, allow_unicode=True)
+                + "---\n"
+            )
         if not self.sections:
-            return ""
-        return "\n\n".join(
-            f"## {section.title}\n\n{section.content}"
-            for section in self.sections
+            if not parts:
+                return ""
+        parts.append(
+            "\n\n".join(
+                f"## {section.title}\n\n{section.content}"
+                for section in self.sections
+            )
         )
+        return "\n".join(parts)
 
 
 class ToolContent(BaseModel):

{sanityops_cli-0.1.5 → sanityops_cli-0.1.7}/src/sanityops_cli/agents/scanner_agent/prompts.py

@@ -190,7 +190,8 @@ For each skill file:
 1. Read the file content using `read` tool
 2. Extract from YAML frontmatter: `name` and `description` fields
 3. Parse markdown sections (## Headings) and capture their content
-4. Report immediately via store_findings
+4. Capture ALL frontmatter fields verbatim into the `frontmatter` object
+5. Report immediately via store_findings
 
 ## Output Schema
 store_findings({{
@@ -201,6 +202,11 @@ store_findings({{
     "content": {{
       "name": "<from_frontmatter>",
       "description": "<from_frontmatter>",
+      "frontmatter": {{
+        "<frontmatter_key>": "<value>",
+        "name": "<from_frontmatter>",
+        "description": "<from_frontmatter>"
+      }},
       "sections": [
         {{"title": "Section Title", "content": "Section content..."}}
       ]
@@ -257,15 +263,16 @@ Return: "Completed: analyzed N tools"
 
 PROMPT_ANALYZER_PROMPT = """\
 You are a prompt analyzer. Analyze the following prompt files and extract full content.
-
 ## Input Files
 {prompt_files}
 
 ## Extraction Rules
 For each prompt file:
-1. Read the file content using `read` tool
-2. Capture full content verbatim
-3. Report immediately via store_findings
+1. Read the file content using `read` tool (use multiple offset/limit calls if needed so EVERY line is read)
+2. Capture full content VERBATIM — copy every line exactly, including all markdown headers, tables, code blocks, and examples, from the first line to the last line of the file
+3. NEVER summarize, truncate, abbreviate, or paraphrase any part of the prompt; the content field must be byte-identical to the file (minus line numbers)
+4. Before reporting, verify your captured content ends with the file's actual last line; if it does not, re-read the missing portion and include it
+5. Report immediately via store_findings
 
 ## Output Schema
 store_findings({{
@@ -279,7 +286,7 @@ store_findings({{
   }}
 }})
 
-**CRITICAL**: Report each file immediately after analysis. Do not batch.
+**CRITICAL**: Report each file immediately after analysis. Do not batch. The prompt `content` you report is the artifact that gets inspected — a truncated or summarized copy produces false defects.
 
 ## Completion
 Return: "Completed: analyzed N prompts"

{sanityops_cli-0.1.5 → sanityops_cli-0.1.7}/src/sanityops_cli/defect_checker/checker.py

@@ -70,11 +70,16 @@ class DefectChecker:
             content = finding.content
             if content is None or finding.type != FindingType.TOOL:
                 continue
-            result.append({
+            # NOTE: inputSchema is the canonical key for the tool input schema.
+            # We also include "parameters" as an alias for backward compatibility
+            # with older consumers. This alias will be deprecated in a future release.
+            schema = {
                 "name": content.name,
                 "description": content.description,
-                "parameters": content.parameters,
-            })
+                "inputSchema": content.parameters,
+                "parameters": content.parameters,  # Deprecated: use inputSchema
+            }
+            result.append(schema)
         return result
 
     def _convert_prompts(self, prompts: list[Finding]) -> list[dict]:

{sanityops_cli-0.1.5 → sanityops_cli-0.1.7}/src/sanityops_cli/defect_checker/markdown_reporter.py

@@ -77,6 +77,40 @@ def _aggregate_cross_defects(cross_results: list[dict]) -> list[dict]:
     return defects
 
 
+def _format_permission_table(defects: list[dict]) -> list[str]:
+    """Generate extended markdown table for QD-PM permission defects.
+
+    Columns: ID | Name | Severity | Description | Action | Permission Side | Duty Side | Fix
+
+    Note: Missing fields display as em dash (—) via _esc_md_cell(None).
+    This differs from terminal renderer which silently omits missing fields.
+    """
+    lines = []
+    lines.append("| ID | Name | Severity | Description | Action | Permission Side | Duty Side | Fix |")
+    lines.append("|---|---|---|---|---|---|---|---|")
+
+    for defect in defects:
+        details = defect.get("details", {})
+        if not isinstance(details, dict):
+            details = {}
+
+        defect_id = _esc_md_cell(defect.get("id") or "unknown-permission-defect")
+        name = _esc_md_cell(defect.get("name"))
+        severity = _esc_md_cell(defect.get("severity"))
+        description = _esc_md_cell(defect.get("description"))
+        action = _esc_md_cell(details.get("action"))
+        permission_side = _esc_md_cell(details.get("permission_side"))
+        duty_side = _esc_md_cell(details.get("duty_side"))
+        fix = _esc_md_cell(defect.get("fix_suggestion"))
+
+        lines.append(
+            f"| {defect_id} | {name} | {severity} | {description} | {action} | "
+            f"{permission_side} | {duty_side} | {fix} |"
+        )
+
+    return lines
+
+
 def _calculate_cross_score(
     defects: list[dict],
     check_level: str,
@@ -188,6 +222,14 @@ def _build_report(
             lines.append("")
             continue
 
+        # Use permission-specific table for QD-PM module.
+        # Renderer also detects via module (primary), category, or ID prefix for consistency.
+        if module == "QD-PM":
+            lines.extend(_format_permission_table(defects))
+            lines.append("")
+            continue
+
+        # Standard defect table for other modules
         lines.append("| ID | Name | Severity | Description | Location | Impact | Fix |")
         lines.append("|---|---|---|---|---|---|---|")
         for defect in defects: