[S8] Markdown export with metadata, disclaimer and escaping of vendor strings

Delivery slice S8 of the Touchstone design.
Part of story #5.

Done when:

touchstone scan --format md renders the report via golden-file tests
Timestamp, tool version, vuln-data date and the fixed Low-confidence disclaimer are always present; lookup_status not COMPLETE renders "lookup incomplete", never a count
A fixture with Markdown/HTML injection in a component name and evidence string renders escaped

Phase: 2 — complete it (after the flow works)
Blocked by: #6
Sprint: #17
Estimate: build 1h · CI+review 3h → ships 2026-10-30 (P50) / 2026-11-03 (P80), else W45 (uncalibrated: first sprint)
Waiting on: none
Runtime: runtime:claude (default)

Passive-only rule applies: only requests a browser loading the page would send, plus the design's discovery paths.

Part of #17 (Sprint 2026-W44)

The agent on the box this repository sends issues to has picked this issue up. It works on its own branch and cannot push; when it finishes, the platform checks what it produced and, if that passes, opens it as a pull request for review.

Next: reply @containarium status to check on it, or @containarium stop to cancel it.

— run d5a75220

No change was proposed for this issue because the agent's answer was not in a form that can be published. Nothing was pushed. Remove and re-add the trigger label to try again.

Next: reply @containarium status to see where this is, or re-add the trigger label to try again.

— run d5a75220

The agent on the box this repository sends issues to has picked this issue up. It works on its own branch and cannot push; when it finishes, the platform checks what it produced and, if that passes, opens it as a pull request for review.

Next: reply @containarium status to check on it, or @containarium stop to cancel it.

— run 5c8dd9c0

feat(report): add Markdown export with metadata, disclaimer and escap…

The agent proposed a change for this issue: #26

It was produced on a member's box and has not been built or tested by the platform. It is a pull request for a person to review; nothing is merged automatically.

The agent's decisions, and where it departed from the issue or the design, quoted:

1. The issue names a fixed 'Low-confidence disclaimer' but the existing service.Disclaimer had no
   Low-confidence sentence, so the constant moved to report.Disclaimer and gained one
   ('Low-confidence findings are inferred from passive fingerprints and are unverified.'); service
   re-exports it and testdata/report.golden.json was regenerated, which also changes the JSON
   output's disclaimer field.
2. The renderer prints the disclaimer from the report package constant rather than from the
   ScanReport.disclaimer field, so a report that arrives without the field still carries it; the
   field is kept in the proto and canned report unchanged.
3. 'lookup incomplete' is rendered both on the report-level 'Vulnerability lookup' line (with the
   PARTIAL/FAILED/unknown reason in parentheses) and on every component's 'Vulnerabilities' line;
   individual vulnerability rows that were found are still listed, since they are findings and not a
   count.
4. Missing metadata (nil timestamps, empty tool version) renders as 'unknown' rather than dropping
   the line, so the timestamp, tool-version and vuln-data-date lines are present in every rendering
   as the issue requires.
5. Golden fixtures are built in Go in the test file (complete, partial, failed, unreachable,
   injection) rather than as JSON fixture files, so the fixtures cannot drift from the proto;
   rendered output lives in internal/report/testdata/*.golden.md and is refreshed with 'go test
   ./internal/report -update'.
6. Escaping strategy: & < > become HTML entities, Markdown punctuation (\ ` * _ [ ] | ~) is
   backslash-escaped, and control characters plus Unicode line/paragraph separators become a space;
   block-level markers are not escaped because the renderer never places a vendor string at the
   start of a line, and a test asserts this.
7. --format accepts 'markdown' as an alias of 'md'; an unknown format is rejected before the scan
   runs so a typo never spends a request budget.
8. README's status paragraph gained two sentences describing --format md; no design document was
   edited.

— run 5c8dd9c0

feat(report): add Markdown export with metadata, disclaimer and escap…

Delivered by merged PR #26. Closed by hand: platform PRs opened before v0.1.223 carry no closing keyword, and issues that list this one on a Blocked by: line wait for it to be closed.

Navigation Menu

Repository navigation

[S8] Markdown export with metadata, disclaimer and escaping of vendor strings #16

4 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[S8] Markdown export with metadata, disclaimer and escaping of vendor strings #16

Description

Activity

containarium-ci commented on Oct 24, 2026

containarium-ci commented on Oct 24, 2026

containarium-ci commented on Oct 24, 2026

4 remaining items

containarium-ci commented on Oct 24, 2026

hsinatfootprintai commented on Oct 26, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions