Argus CLAUDE.md

Argus — Project Context for Claude Code

What This Project Is

Argus is an AI-driven automated QA harness that audits web pages using Chrome DevTools Protocol (CDP) via the chrome-devtools MCP server. It catches bugs, compares dev vs staging environments, and reports to Slack with screenshots.

Skill Reference

CRITICAL: Read SKILL.md before starting any Argus task. It is the canonical reference for:

• All MCP tool signatures and parameters
• Flow Runner DSL step actions
• Assertion patterns for test-harness/validate.js
• Common failure modes and fixes
• Harness statistics (167 blocks, 973 hard assertions, 67 detection categories)

Project Structure

src/
  argus.js                    — single-page audit entry point
  batch-runner.js             — multi-page batch audit
  mcp-server.js               — Argus MCP server; exposes argus_audit / argus_audit_full / argus_compare / argus_last_report / argus_watch_snapshot / argus_get_context / argus_design_audit / argus_visual_diff / argus_pr_validate (Aegis Step 4: all 9 responses redacted at the egress boundary via egressResult / redactReport / deepScrub + a `redaction` rider; handleAudit `ctx.internal` keeps pr_validate's block logic on raw findings)
  adapters/
    browser.js                — CdpBrowserAdapter — wraps all mcp.* calls
    figma.js                  — Figma REST adapter — getFigmaFrame() + parseFigmaUrl()
  domain/
    finding.js                — createFinding() factory
  registry.js                 — analyzer plugin registry (registerCheap/registerExpensive/getCheap/getExpensive/clearAll)
  orchestration/
    crawl-and-report.js       — backward-compat re-export shell
    orchestrator.js           — crawl loop + runCrawl
    report-processor.js       — dedup → baseline → root-cause → Aegis step 3c (classifySensitivity, fail-CLOSED) → JSON write
    dispatcher.js             — Slack / GitHub / HTML dispatch
    slack-notifier.js         — Slack Block Kit message builder
    env-comparison.js         — dev vs staging diff
    watch-mode.js             — passive browser monitoring (npm run watch)
  server/
    index.js                  — Express server (port 3001) for Slack slash commands + interactions
    slash-command-handler.js  — /argus-retest slash command handler
    interaction-handler.js    — Acknowledge + Retest button handler
  cli/
    init.js                   — C4: argus init interactive setup wizard
    chrome-launcher.js        — findChrome()/launchChrome() cross-platform binary detection; npm run chrome / argus-chrome bin
    doctor.js                 — checkChrome/checkMcpConfig/checkEnvKeys pre-flight checks; npm run doctor / argus-doctor bin
    pr-validate.js            — headless CI entry point for GitHub Actions; exports buildStepSummary / writeGithubOutputs / writeStepSummary / checkTargetReachable / normalizeRoutePaths
  utils/
    logger.js                 — Pino structured logger; childLogger(module)
    retry.js                  — withRetry() exponential-backoff wrapper
    telemetry.js              — OTel tracing + metrics; startSpan() / recordFinding() / recordFlaky() / recordNewFindings(); no-op default
    flow-runner.js            — DSL step executor (D8 flow steps)
    mcp-parsers.js            — text-format parsers for list_console_messages / list_network_requests
    mcp-client.js             — headless JSON-RPC MCP client
    seo-analyzer.js           — A3: SEO checks
    security-analyzer.js      — A4: security checks
    content-analyzer.js       — A5: content quality
    responsive-analyzer.js    — A6: viewport emulation + overflow
    memory-analyzer.js        — B1: heap snapshot + detached DOM
    session-manager.js        — B2: backward-compat re-export barrel
    session-persistence.js    — B2: saveSession / restoreSession / hasSession / clearSession
    login-orchestrator.js     — B2: runLoginFlow / refreshSession + lock file
    baseline-manager.js       — B3: historical baselines + trend tracking
    flakiness-detector.js     — B4: double-crawl, confirm vs flaky
    noise-filter.js           — MIT post-processors: cross-run flip-flop noise classifier; downgrades noisy findings to info; <branch>-history.json
    root-cause-linker.js      — MIT post-processors: recent git commits → suspect files per new finding (slug heuristic, no API)
    hover-analyzer.js         — D8.1: hover-state bug detection
    snapshot-analyzer.js      — D8.2: accessibility tree analysis
    keyboard-analyzer.js      — keyboard Tab-walk focus analysis
    issues-analyzer.js        — Chrome DevTools Issues panel (CSP/CORS/deprecated)
    network-timing-analyzer.js — HAR timing analysis for slow third-party detection
    lighthouse-checker.js     — Lighthouse soft assertions
    codebase-analyzer.js      — C1: static source analysis
    github-reporter.js        — C2: PR comment + commit status + Check Runs
    route-discoverer.js       — C3: sitemap + Next.js + React Router discovery
    contract-validator.js     — D7.4: API response schema validation
    parallel-crawler.js       — D7.3 chunkArray + D1 mapWithConcurrency/auditRoutesConcurrently (bounded-concurrency route auditing) + D4 withTimeout/auditRouteWithRetry/routeResilienceFromEnv (per-route timeout/retry)
    html-reporter.js          — D7.1: HTML dashboard bundler
    severity-overrides.js     — D7.5: post-process severity policy
    slack-guard.js            — D7.7: Slack-optional guard
    api-frequency.js          — request frequency tracking
    css-analyzer.js           — CSS rule analysis
    theme-analyzer.js         — A7: Theme & Dark Mode detection
    design-fidelity-analyzer.js — D9: Figma design token vs DOM comparison
    web-vitals-analyzer.js    — Web Vitals: LCP/CLS/FCP/TTI/TTFB via Performance API + bundle size regression
    visual-diff-analyzer.js   — A8: Visual regression — pixelmatch screenshot baseline comparison
    a11y-deep-analyzer.js     — A12: Deep Accessibility — axe-core 4.12 injection (80+ WCAG rules) + protanopia/deuteranopia CVD color blind simulation
    har-recorder.js           — N1: HAR Network Baseline — record + diff network requests per route
    motion-analyzer.js        — A9: Motion & Animation — prefers-reduced-motion + autoplay detection
    font-analyzer.js          — A10: Font Loading — FOIT/FOUT/fallback/slow/suboptimal-format detection
    form-analyzer.js          — A11: Form Validation — required/autocomplete/aria/validation gaps
    pr-diff-analyzer.js       — parsePrUrl() / fetchPrFiles() / mapFilesToRoutes() (slug heuristic) / mapFilesToRoutesDeep() (C1–C3 framework-aware: import-graph + Next.js convention + monorepo re-basing + non-global stylesheet attribution) / firstAddedLine / resolveAnnotationTarget — PR diff → affected routes + file:line annotations
    import-graph.js           — C1/C3: static ES/CJS + stylesheet import graph (buildImportGraph fwd/rev, findDependents, resolveSpecifier, tsconfig alias) — maps a changed component/stylesheet to the routes whose pages import it
    pr-baseline.js            — B1/B2: decidePrBlock (shared baseline-aware merge-block decision) / diffRoutesAgainstBaseline / tagFindingNovelty / resolve|load|savePrBaseline
    audit-depth.js            — D2: selective analyzer depth — resolveAuditDepth (fail-safe → cheap) / selectAnalyzers (file-type-aware) / STANDARD_POLICY / ALL_EXPENSIVE_ANALYZERS / runDepthAnalyzers (ARGUS_PR_AUDIT_DEPTH, opt-in)
    deploy-preview.js         — D3: deploy-preview URL auto-detection — resolveTargetUrl (explicit → env preview → opt-in GitHub-Deployments probe → TARGET_DEV_URL) / previewUrlFromStatuses (most-recent SUCCESS only) / fetchPreviewUrlFromDeployments (fail-safe)
    diff.js                   — finding diff utilities
    slug.js                   — URL slug helpers
    pdf-exporter.js           — exportReportToPdf / exportPageToPdf via puppeteer (optional peer dep); npm run report:pdf
    screen-recorder.js        — PollingRecorder (zero-dep screenshot intervals) + CdpScreenRecorder (ws dep, Page.startScreencast, auto-ffmpeg)
    secret-patterns.js        — Aegis (REDACTION_BOUNDARY_MAX_PLAN.md) Step 1: zero-dep secret/PII core — SECRET_RULES (13) + PII_RULES (7, Luhn-validated card) + CONTEXT_WORDS; shannonEntropy/luhnValid/isStatisticallyRare/findSensitiveSpans/scrubText/stripZeroWidth; setTokenizer+tokenEfficiency seam (Layer 3 = Token Efficiency when a BPE encoder is injected; Shannon entropy is the live zero-dep fallback); scrubText `token` mode + setVaultTokenizer seam (Step 8 — injected reversible vault tokenizer; mode=token FAILS CLOSED to mask when no vault wired, stays I/O-free). Re-exports scrubSecrets from github-api.js (byte-unchanged)
    sensitivity-classifier.js — Aegis Step 2: classifyFinding (5 layers) / classifySensitivity (clone-tag walk, fail-CLOSED) / redactForEgress (deny-by-default field allowlist, fail-CLOSED, ARGUS_REDACT_SENSITIVE=0 passthrough; a sensitive finding carries message=REDACT_MARKER so it satisfies the golden findingSchema) / summarizeRedaction / sanitizeUrl. Step-4 egress helpers: buildRedactionRider (the `redaction` rider) / deepScrub (loose console/network/diff scrubbing) / redactReport (report-shaped projection: routes[].errors/findings/diffs + flows + codebase, preserves metadata, honours _aegisFailClosed). Step 3 (wired): report-processor.js step 3c tags findings before the JSON write (local fidelity preserved). Step 4 (wired): mcp-server.js redacts all 9 MCP tool responses. Steps 5–7 (wired): dispatcher.js (Slack — redacted report clone + 🔒 digest footer), github-reporter.js (reportToGitHub via redactReport; reportPrValidation via redactForEgress + a `redaction` rider rendered by formatPrComment), html-reporter.js (generateHtmlReport(path,{external}) + shouldRedactHtml — local-open + on-disk JSON stay RAW), cli/pr-validate.js (safeFindingLine + scrubbed ::error/::warning annotations + redacted printed JSON) — all fail-CLOSED + ARGUS_REDACT_SENSITIVE=0 opt-out, pure formatters untouched. Step 8 (wired): ensureVaultWired() lazily registers the aegis-vault token seam from redactForEgress/deepScrub when ARGUS_REDACT_MODE=token. Step 9 (docs) DONE: the default-ON behavior-change RELEASE note landed in a NEW CHANGELOG.md ([Unreleased] — Aegis); the ARGUS_REDACT_* env blocks landed in .env.example + this file; the public README/OG move to v9.9.0 numbers (978/168) on the Aegis release; REFERENCE.md unchanged (Aegis emits no new finding type). Aegis Steps 1–9 COMPLETE — released in v9.9.0
    aegis-vault.js            — Aegis Step 8: OPTIONAL reversible re-hydration vault (default OFF, ARGUS_REDACT_VAULT=1). tokenFor/computeToken (deterministic HMAC-SHA256 AEGIS_<hmac16>, information-free) / storeMapping / loadVault / rehydrate / getKey (per-machine 0600 key) / appendAudit (secret-free provenance) / ensureVaultWired / vaultEnabled; vault + audit files 0600 under reports/.aegis-vault|.aegis-audit (gitignored, relocatable via ARGUS_REDACT_VAULT_DIR/_AUDIT_DIR). The ONLY Aegis module that does filesystem I/O; secret-patterns.js stays pure (tokenFor injected via setVaultTokenizer). scripts/rehydrate-report.mjs + npm run report:rehydrate re-inflate a redacted report locally. Crypto: HMAC (not format-preserving) — if shape-preserving tokens are ever added, NIST FF1 only (FF3/FF3-1 withdrawn Feb 2025)
    redaction-policy.js       — Aegis-for-Teams engine `policy` param (AEGIS_FOR_TEAMS_PLAN.md §4.2/§9): the structured-org-policy resolver the Enterprise governance seam applies. Pure + zero-dep + zero-I/O + NO engine imports (no circular dep). resolvePolicy (fail-CLOSED to STRICT_DEFAULT on missing/malformed/throwing) / policyOpts / policyFromEnv (ARGUS_REDACT_POLICY inline JSON, cached; SET-but-malformed ⇒ strict floor) / effectivePolicyOpts (opts.policy raw §4.2 policy > env > none) / _resetPolicyCacheForTests. A valid policy narrows the rule set (rules.secret.all / rules.pii.<name>:false), ADDS org-custom secret rules (rules.secret.extra, compiled fail-safe /g, additive), WIDENS the sensitive-type set (union, `prefix_*` glob), and NARROWS the egress field allowlist (intersection with EGRESS_ALLOWLIST — never widens); floor.failOpen FORCED false. The entropy layer + category/body-field catch-alls are NOT policy-toggleable (the no-leak floor). Threaded via opts through findSensitiveSpans/scrubText (ruleFilter/extraSecretRules), classifyFinding/isSensitiveType (sensitiveTypes union), projectFinding/redactForEgress (allowSet intersection), deepScrub/redactReport/summarizeRedaction/buildRedactionRider. NO policy ⇒ byte-identical to v9.9.0 (opt-in). Also hosts the pure `setGovernanceSource`/`governanceOptOutClamped` injection seam (fed by governance-seam.js) — `effectivePolicyOpts` precedence: explicit opts.policy > governance source > ARGUS_REDACT_POLICY env; the clamp lets the classifier ignore ARGUS_REDACT_SENSITIVE=0 under a gov token
    governance-seam.js        — Aegis-for-Teams governance seam (AEGIS_FOR_TEAMS_PLAN.md §9): the OPT-IN, self-hosted/CI network bridge to a central control plane. Fetch the org's Ed25519-SIGNED policy from ARGUS_REDACT_POLICY_URL (bearer ARGUS_GOV_TOKEN), verify against the pinned ARGUS_REDACT_POLICY_PUBKEY (PEM), apply through the redaction-policy.js `policy` param, cache with TTL (ARGUS_REDACT_POLICY_TTL_MS, default 5min). ensureGovernancePolicy (async, best-effort, NEVER throws) / verifySignedPolicy (throws on bad-sig/wrong-key/missing-pubkey) / canonicalPolicyBytes (key-sorted, cloud-signer interop) / postRedactionAggregate (SECRET-FREE byReason label counts → ARGUS_REDACT_AUDIT_URL, best-effort) / governanceActive / governancePolicyVersion. FAIL-CLOSED everywhere: any fetch/verify/parse error ⇒ the STRICT floor (redaction never loosened). INERT without ARGUS_GOV_TOKEN ⇒ byte-identical to v9.9.0 (open-core: no phone-home, no new dep, no perf/privacy cost by default). Wired into report-processor.js processReport (fetch at start, secret-free aggregate after step 3c). The §9 team-vault routing bullet now lives in team-vault.js (below)
    team-vault.js             — Aegis-for-Teams team-vault routing (AEGIS_FOR_TEAMS_PLAN.md §9, the last T3 sub-item): when ARGUS_REDACT_MODE=token AND a gov token AND ARGUS_REDACT_VAULT_URL are set, route the reversible token→secret mapping to the org's CENTRAL team vault (re-hydratable through the cloud's authorized RBAC `Reveal ▸` flow) INSTEAD of the local 0600 file. teamVaultActive (gov token + vault URL) / teamTokenFor (SYNC: computeToken HMAC + buffer the mapping, deduped, MAX_BUFFER cap) / ensureTeamVaultWired (wires teamTokenFor on the setVaultTokenizer seam) / ensureTokenVaultWired (the unified `token` mode entry the classifier calls — team vault > local vault, §4.3) / flushTeamVault (async best-effort POST `{mappings:[{token,secret}],artifactRef}` bearer-authed to ARGUS_REDACT_VAULT_URL; the SECRET goes ONLY here, encrypted at rest cloud-side; the info-free token crosses every OTHER sink) / pendingTeamVaultCount / _resetTeamVaultForTests. FAIL-CLOSED: a throwing/HTTP-error flush never throws + retains the buffer (the emitted token is information-free — a failed flush leaks nothing, only forgoes central re-hydration); token mode with the seam OFF falls back to the local vault / mask. INERT unless BOTH knobs set ⇒ byte-identical to v9.9.0 (no phone-home, no new dep). Uses ONLY the global fetch. sensitivity-classifier.js redactForEgress/deepScrub call ensureTokenVaultWired at token mode; mcp-server.js calls flushTeamVault after each tool response (the primary OSS egress boundary)
  config/
    targets.js                — URL targets + auth steps + centralized thresholds
    schema.js                 — Zod validation schema for targets.js; validateConfig() called inside runCrawl()
action.yml                    — composite GitHub Action (Argus PR Validator); inputs: target-url, github-token, block-on, pr-url, routes-file, chrome-flags, node-version
.mcp.json                     — MCP server registration — npx argusqa-os entry; argus server for Claude / MCP clients
landing/
  src/
    App.jsx                   — single-page React app (hero + nav "Growth" link, growth charts, features, comparison, waitlist modal, enterprise modal)
    supabase.js               — Supabase client factory; exports null if VITE_SUPABASE_* env vars missing
    theme.js                  — single source of truth for the brand/status palette (ACCENT + accent()/success()/warning() rgba helpers)
    useNpmDownloads.js        — live npm download stats hook (api.npmjs.org, sessionStorage-cached) + aggregate() (day/week/month/year)
    DownloadBadge.jsx         — hero count-up badge: centre purple band → docks bottom-right square; live npm total
    DownloadsSection.jsx      — Growth section: npm (live) / GitHub Traffic / Security source tabs, Recharts drag-to-zoom + animated Socket scorecard + false-positive debunk
    growthData.js             — static snapshots for sources with no public live API (GitHub traffic, Socket scores, Pulse rank/visitors)
  public/
    favicon.svg               — SVG favicon replicating Logo() component (#5E0ED7 ring + dot)
    argus-poster.png          — video poster fallback (1918×1078; source for OG card)
    og-image-v3.jpg           — branded OG social card (1200×630; real-pixel-bg reconstruction with 67/166/961 stat numbers)
    robots.txt                — allows all crawlers; Sitemap reference
    sitemap.xml               — canonical URL for argus-qa.com/
  index.html                  — Vite entry; OG/Twitter/JSON-LD SEO tags; canonical; favicon link
  package.json                — React 19, Vite 8, Tailwind, Framer Motion 12, Recharts, @supabase/supabase-js
  .env.example                — committed template: VITE_SUPABASE_URL, VITE_SUPABASE_ANON_KEY
  .env.local                  — gitignored — real Supabase credentials (copy from .env.example)
test-harness/
  validate.js                 — 171-block correctness harness (blocks [80]–[84] MCP/createFinding/withRetry/watch/init; [85]–[93] Tier 3; [94]–[126] gap-close; [127] A7 theme; [128] D9 design fidelity; [129] Web Vitals; [130] A8 Visual Regression; [131] A12 Axe-core; [132] N1 HAR; [133] A9 Motion; [134] A10 Font; [135] A11 Form; [136] GitHub Check Runs; [137] PR Diff Analyzer + EXCLUDED_PATTERNS [137i–k] + fetchPrFiles status/patch [137l–o] + diff-hunk annotations [137p–r]; [138] GitHub Action CLI + preflight/normalize/guard [138k–p]; [139] Chrome launcher + doctor + security extensions [139a–k]; [140] noise filter [140a–g]; [141] root cause linker [141a–h]; [142] MCP wire-contract regressions [142a–i]; [143] CdpBrowserAdapter wire-contract conformance [143a–zz]; [144] MCP tool error-path matrix [144a–p]; [145] multi-tab end-to-end [145a–f]; [146] anti-vacuous self-lint [146a–e]; [147] golden MCP response schemas [147a–p] via contracts/mcp-tool-schemas.js (incl. [147o]/[147p] — argus_pr_validate reporting/baseline rider shapes, F4); [148] upstream canary [148a–e] via contracts/[email protected]; [149] per-category negative controls [149a–e] — 65-category over-fire sweep driving the real pipeline against negative-controls.html; [150] verification-gap closure [150a–m] — positive firing fixtures for the previously-untriggered focus_lost / security_no_https / cors_violation / cookie_attribute_missing detectors; [151] PR-validate idempotent PR comment [151a–g]; [152] PR-validate Check Run conclusion [152a–f]; [153] PR-validate MCP reporting parity [153a–c]; [154] PR-validate baseline-aware blocking [154a–g]; [155] PR-validate new/persisting/resolved comment [155a–e]; [156] PR-validate framework-aware route mapping [156a–k] (C1 — import-graph); [157] PR-validate monorepo path awareness [157a–h] (C2); [158] PR-validate stylesheet attribution [158a–g] (C3 — non-global CSS narrows to its importing routes); [159] PR-validate bounded-concurrency route auditing [159a–e] (D1); [160] PR-validate selective analyzer depth [160a–i] (D2); [161] PR-validate deploy-preview URL auto-detection [161a–e] (D3); [162] PR-validate per-route timeout/retry + all-routes-failed guard [162a–e] (D4); [163] PR-validate GitHub API resilience [163a–e] (E2); [164] PR-validate block-decision + guard matrix [164a–g] (E3); [165] PR-validate CLI↔MCP block-decision parity [165a–d] (E4); [166] PR-validate recorded GitHub reporting fixtures [166a–d] (F1); [167] PR-validate CLI end-to-end child-process [167a–h] (F2); [168] Aegis confidentiality egress boundary [168a–l] — drives the real pipeline (crawlRouteCheap + processReport step-3c) against sensitive-findings.html: security_* findings tagged sensitive, redactForEgress leaks no JWT/key/email/card substring, query-string stripped, on-disk fidelity preserved, fail-CLOSED ([168g]); Step-4 MCP egress: [168i] the `redaction` rider safeParses + a retyped rider is rejected, [168k] a LIVE argus_audit on the fixture (spawned server) leaks no secret + carries the rider, [168l] the same audit with ARGUS_REDACT_SENSITIVE=0 returns the secret RAW — opt-out + non-vacuity; [169] Aegis egress-sink guards [169a–e] (Slack/GitHub/HTML/CI — network-free, redacted PR comment + external HTML + step summary, each with an opt-out non-vacuity leak); [170] Aegis-for-Teams engine `policy` param [170a–g] (Chrome-free/pure: a policy toggle flows through the real redactForEgress projector, sensitiveTypes widens-only, egress allowlist narrows-only, malformed/throwing policy fails CLOSED, no-leak floor holds with secret rules OFF, no-policy byte-identical, ARGUS_REDACT_POLICY env valid+malformed); [171] Aegis-for-Teams governance seam [171a–g] (the OPT-IN Ed25519 fetch/verify network wrapper over [170]: [171a] signed policy verifies + email-OFF toggle applies through redactForEgress + a TAMPERED body is rejected→strict floor, [171b] wrong-key rejected, [171c] unreachable/malformed/HTTP-error all fail CLOSED, [171d] SECRET-FREE aggregate POST (tainted label + runRef scrubbed, counts preserved), [171e] gov token CLAMPS ARGUS_REDACT_SENSITIVE=0 + no-token inert/byte-identical, [171f] TTL cache, [171g] LIVE HTTP fetch→verify→apply→aggregate over a spawned Ed25519 mock control plane); [172] Aegis-for-Teams team-vault routing [172a–f] (mode=token → central vault, INERT unless ARGUS_GOV_TOKEN + ARGUS_REDACT_VAULT_URL are both set: opt-in activation, mint+buffer+no-leak via the real deepScrub, LIVE flush to a spawned localhost sink (secret to the authorized endpoint ONLY, buffer cleared), fail-CLOSED on throw/HTTP-error, opt-in default-identical, team>local precedence))
  harness-config.js           — fixture page routing table
  contracts/
    mcp-tool-schemas.js       — golden Zod response schemas for the 9 MCP tools (block [147]; exported for E2E)
  .env.harness                — ARGUS_LOG_LEVEL=warn — suppresses Pino INFO flood during harness runs (auto-loaded by test:harness)
  run-with-log.mjs            — tee wrapper: streams output live to terminal AND saves full output to harness-results.txt
  pages/                      — 64 fixture HTML pages
  server.js                   — fixture HTTP server
  nextjs-fixture/             — Next.js pages/+app/ structure for C3 route discovery tests
  source-fixture/             — JS source + .env fixture for C1 codebase analysis tests
  import-graph-fixture/       — Next.js pages/ app (components + stylesheets) for PR-Validator C1/C3 import-graph mapping (blocks [156]/[158])
  import-graph-monorepo-fixture/ — monorepo (apps/web) variant for PR-Validator C2 path awareness (block [157])
test/
  unit/                       — 24 Vitest unit test files (495 tests); run with npm run test:unit
scripts/
  dispatch-report.js          — standalone Slack re-dispatch for an existing JSON report
  coverage-gate.mjs           — merges unit (vitest-v8) + harness (c8) coverage; gates --min-lines + --allow-uncovered
  gen-finding-types.mjs       — scans src/ for emitted finding type: literals → REFERENCE.md "Finding Type Catalog" (149 types / 29 modules)
.c8rc.json                    — c8 config for the harness coverage half (all src/**, json report → coverage/harness/)
vitest.config.js              — Vitest config; coverage block (v8) drives the unit half → coverage/unit/
reports/
  baselines/                  — baseline.json + trends.json (gitignored)