{# Exploitability Report — INTERNAL (Console) variant. This template OWNS the document chrome + render-mode gate. The shared kind-aware verdict card lives in _exploitability_macros.html; the shared .exp-* CSS lives in _exploitability_style.html (included once, OUTSIDE the gate, so the fragment_extractor auto-scopes it). CUTOVER GUARD: a v2 dataset yields {subject, summary, buckets, bucket_counts, record_count}; the §0-§7 IA renders under {% if buckets %}. A legacy v1 dataset yields {cover, coverage, cards}; the {% else %} branch keeps rendering it until the §10 cutover. No charts, no CDN, no JS. PDF re-renders this HTML. #} {# Defensive defaults — BEFORE the gate. #} {% set cover = cover | default({}) %} {% if cover is not mapping %}{% set cover = {} %}{% endif %} {% set coverage = coverage | default({}) %} {% if coverage is not mapping %}{% set coverage = {} %}{% endif %} {% set cards = cards | default([]) %} {% if cards is mapping or cards is string or cards is not iterable %}{% set cards = [] %}{% endif %} {% set subject = subject | default({}) %} {% if subject is not mapping %}{% set subject = {} %}{% endif %} {% set buckets = buckets | default(None) %} {% set mode = mode | default('internal') %} {% import "_console_macros.html" as fs with context %} {% import "_exploitability_macros.html" as exp with context %} {% if render_mode != 'fragment' %} {% if domain %}{% endif %} Exploitability Report{% if buckets %}{% if subject.scope_descriptor %} — {{ subject.scope_descriptor }}{% endif %}{% elif cover.subject %} — {{ cover.subject }}{% endif %} {% include "_design_system.html" %} {% include "_console_shell.html" %} {% endif %} {# Shared family CSS — OUTSIDE the gate so the extractor scopes it. #} {% include "_exploitability_style.html" %} {% if render_mode != 'fragment' %} {% endif %} {% if render_mode != 'fragment' %} {% if buckets %} {% set exp_meta = [{"label": "Mode", "value": "Internal"}] %} {% if subject.project_name %}{% set _ = exp_meta.append({"label": "Project", "value": subject.project_name}) %}{% endif %} {% if subject.version_label %}{% set _ = exp_meta.append({"label": "Version", "value": subject.version_label}) %}{% endif %} {% if record_count is not none %}{% set _ = exp_meta.append({"label": "Findings", "value": record_count}) %}{% endif %} {% set _ = exp_meta.append({"label": "Generated", "value": subject.generated_at or generated_at or "—"}) %} {% if subject.report_id %}{% set _ = exp_meta.append({"label": "Report", "value": subject.report_id}) %}{% endif %} {% else %} {% set exp_meta = [{"label": "Mode", "value": "Internal"}] %} {% set _ = exp_meta.append({"label": "Catalog", "value": cover.catalog_version or "—"}) %} {% set _ = exp_meta.append({"label": "Agent", "value": cover.agent_version or "—"}) %} {% set _ = exp_meta.append({"label": "Generated", "value": cover.generated_at or generated_at or "—"}) %} {% endif %} {{ fs.topbar( crumbs=["Finite State", "Exploitability Evidence", "Exploitability Report"], meta=exp_meta, controls=[], ) }} {% endif %}
{# §0 Identity — the ONE section-title marker (adapts to v2/v1; the fragment extractor flags exactly one element as the title). #}

Exploitability Report{% if buckets and subject.scope_descriptor %} — {{ subject.scope_descriptor }}{% endif %}

{% if buckets %}Internal console (full verifier telemetry).{% if subject.project_name %} Project {{ subject.project_name }}{% endif %}{% if subject.version_label %} · {{ subject.version_label }}{% endif %}{% if subject.platform %} · {{ subject.platform }}{% endif %}{% else %}Per-verdict exploitability dossier — internal console view (full verifier telemetry).{% endif %}

{% if buckets %} {# §1 Decision summary. #} {{ exp.decision_summary(summary, bucket_counts) }} {# §2-§5b card buckets. #} {{ exp.card_section(buckets, 'exploitable', 'Must-fix — proven exploitable', mode) }} {{ exp.card_section(buckets, 'not_affected', 'Proven not exploitable', mode) }} {{ exp.card_section(buckets, 'inconclusive', 'Tested, inconclusive', mode) }} {{ exp.card_section(buckets, 'verifier_failed', 'Could not be assessed', mode) }} {# §5 Affected by version — compact table. #} {% set ver = buckets.get('affected_by_version') or [] %} {% if ver %}

Affected by version {{ ver | length }}

Not individually pen-tested — the on-device version predates the upstream fix. Remediate by the upgrade in the decision summary.

{{ exp.version_table(ver) }}
{% endif %} {# §6 Method & honesty notes. #}
How to read this.
{% else %}

Verified {{ cover.N | default(0) }} of {{ cover.M | default(0) }} findings in {{ cover.scope_label | default('scope') }}; the remaining {{ (cover.M | default(0)) - (cover.N | default(0)) }} are untested, not cleared.

Internal · Catalog {{ cover.catalog_version | default('—') }} · Agent {{ cover.agent_version | default('—') }} · Generated {{ cover.generated_at | default(generated_at) | default('—') }}

{% if cards %} {% for card in cards %}{{ exp.verdict_card(card, mode) }}{% endfor %} {% else %}

No verdict records in scope.

{% endif %}
What the verifier does. The CVE Evidence Verifier attempts to prove whether each finding is actually exploitable in the built artifact — running static dataflow, symbol scans, and dynamic traces under emulation — and seals every verdict with a replayable evidence bundle. Each card above can be reproduced byte-for-byte with replay_pen_test <bundle_id>.
{% endif %}
{% if render_mode != 'fragment' %} {% endif %}