report

type DetectorVerdictSummary struct {
	Tool       string  `json:"tool"`
	Verdict    string  `json:"verdict"`
	Confidence float64 `json:"confidence"`
	DetectedBy string  `json:"detected_by"`
	Evidence   string  `json:"evidence,omitempty"`
}

type JSONRenderer struct{}

type MarkdownRenderer struct{}

type Renderer interface {
	Render(s Summary) ([]byte, error)
}

type Summary struct {
	SessionID string
	StartedAt time.Time
	EndedAt   time.Time

	// Counts, populated by walking the audit entries.
	TotalEntries int
	BySuccess    map[bool]int   // true=success, false=failure
	ByRisk       map[string]int // "low" / "medium" / "high" / "critical" / ""
	ByLevel      map[audit.Level]int
	ByTool       map[string]int

	// ATT&CK coverage. Each technique ID maps to the number of tool
	// invocations that contributed to it.
	ATTACKCoverage map[string]int

	// DetectorVerdicts groups the verdicts the DetectorEngine
	// emitted during the session. Extracted from each audit entry's
	// Output by matching the <detector-verdict>{...}</detector-verdict>
	// block appended by appendDetectorVerdicts. Keyed by detector
	// name for heatmap display.
	DetectorVerdicts []DetectorVerdictSummary

	// Timeline is the chronologically ordered entry list. Callers that
	// only want the summary counts can ignore this; the markdown
	// renderer uses it for the timeline section.
	Timeline []audit.Entry

	// TotalDuration sums all entry.Duration fields (in milliseconds).
	// Gives the report a "hands-on" time estimate distinct from
	// StartedAt/EndedAt which span idle periods too.
	TotalDurationMs int64
}