Four defects the architecture review of #35 found that were not fixed in that PR, kept together because they share a cause: the report renders by building a Markdown string and then re-parsing it.
1. Truncation drops the evidence that produced the score
EvidenceReport.cs takes the first 40 findings, and the analyzer orders findings by position in the text, not by weight, while the score sums all of them. In a long document, forty weak hits in the opening chapter push a strong signal in the last paragraph out of the report — even though that signal is part of why the headline number is what it is. The reader gets a score the visible evidence cannot account for.
The citation section truncates at 40 too, and unlike the folder table it does not print how many were omitted.
Fix: order by weight for display, keeping position so the reader can find each one, and always state what was left out.
2. ToMarkdown passes raw HTML through
ToHtml escapes angle brackets; ToMarkdown does not, and it is the form documented for pasting into an LMS comment box or a GitHub issue — both of which render raw HTML in Markdown. A document containing <img src=x onerror=…> reaches those renderers intact.
Fix: escape HTML-significant characters in the Markdown path too.
3. Emphasis markers do not nest
Inline/Wrap pair markers positionally, so **bold *italic** rest* produces crossed tags, and asterisks inside a code span are still processed as italics afterwards. Content is mangled rather than injected, but the matched text is the thing this product's credibility rests on reproducing exactly.
4. The real cause
All three follow from rendering to Markdown and re-parsing it. Building the HTML from the model with escaped text nodes, and emitting Markdown separately with contextual escaping, removes the class of defect rather than the instances. The alternative — a CommonMark parser — is a dependency this library refuses, and it would not fix the Markdown side anyway.
Also from that review, smaller and independent:
- The build is two-phase and nothing enforces it.
tools/SignsOfAI.Calibration has a ProjectReference to Core, so Core is compiled before the run writes published-calibration.json. The freshly built assembly therefore carries the previous snapshot; dotnet pack --no-build would ship it. CI should compare the embedded resource against the source file and fail if they differ.
- A custom rule pack invalidates the published rate.
--rules and the public Analyze(text, language, extraPacks) let a caller change which rules fire, while the report still quotes the figure measured for the built-in packs. The result should carry the provenance of the pack it was analysed with, and the report should say "not calibrated" when that provenance is not the measured one.
Four defects the architecture review of #35 found that were not fixed in that PR, kept together because they share a cause: the report renders by building a Markdown string and then re-parsing it.
1. Truncation drops the evidence that produced the score
EvidenceReport.cstakes the first 40 findings, and the analyzer orders findings by position in the text, not by weight, while the score sums all of them. In a long document, forty weak hits in the opening chapter push a strong signal in the last paragraph out of the report — even though that signal is part of why the headline number is what it is. The reader gets a score the visible evidence cannot account for.The citation section truncates at 40 too, and unlike the folder table it does not print how many were omitted.
Fix: order by weight for display, keeping position so the reader can find each one, and always state what was left out.
2.
ToMarkdownpasses raw HTML throughToHtmlescapes angle brackets;ToMarkdowndoes not, and it is the form documented for pasting into an LMS comment box or a GitHub issue — both of which render raw HTML in Markdown. A document containing<img src=x onerror=…>reaches those renderers intact.Fix: escape HTML-significant characters in the Markdown path too.
3. Emphasis markers do not nest
Inline/Wrappair markers positionally, so**bold *italic** rest*produces crossed tags, and asterisks inside a code span are still processed as italics afterwards. Content is mangled rather than injected, but the matched text is the thing this product's credibility rests on reproducing exactly.4. The real cause
All three follow from rendering to Markdown and re-parsing it. Building the HTML from the model with escaped text nodes, and emitting Markdown separately with contextual escaping, removes the class of defect rather than the instances. The alternative — a CommonMark parser — is a dependency this library refuses, and it would not fix the Markdown side anyway.
Also from that review, smaller and independent:
tools/SignsOfAI.Calibrationhas aProjectReferenceto Core, so Core is compiled before the run writespublished-calibration.json. The freshly built assembly therefore carries the previous snapshot;dotnet pack --no-buildwould ship it. CI should compare the embedded resource against the source file and fail if they differ.--rulesand the publicAnalyze(text, language, extraPacks)let a caller change which rules fire, while the report still quotes the figure measured for the built-in packs. The result should carry the provenance of the pack it was analysed with, and the report should say "not calibrated" when that provenance is not the measured one.