{# Exploitability Report — EXTERNAL (Briefing) variant.

   Extends _briefing_shell.html (the shell OWNS the document wrapper +
   render-mode gate). This child fills blocks only.

   CUTOVER GUARD: a v2 dataset (spec 2026-06-23 §5) yields the bucketed view
   model {subject, summary, buckets, bucket_counts, record_count}; the §0-§7 IA
   below renders under {% if buckets %}. A legacy v1 dataset yields
   {cover, coverage, cards}; the {% else %} branch keeps rendering it verbatim
   until the §10 cutover. Shares _exploitability_macros.html + _exploitability_style.html
   with the console variant. No charts, no CDN, no JS. #}
{% extends "_briefing_shell.html" %}

{# Defensive defaults (both shapes). #}
{% set cover = cover | default({}) %}
{% if cover is not mapping %}{% set cover = {} %}{% endif %}
{% set cards = cards | default([]) %}
{% if cards is mapping or cards is string or cards is not iterable %}{% set cards = [] %}{% endif %}
{% set subject = subject | default({}) %}
{% if subject is not mapping %}{% set subject = {} %}{% endif %}
{% set buckets = buckets | default(None) %}
{% set mode = mode | default('external') %}

{% block title %}Exploitability Report{% if buckets %}{% if subject.scope_descriptor %} — {{ subject.scope_descriptor }}{% endif %}{% elif cover.subject %} — {{ cover.subject }}{% endif %} - Finite State Report{% endblock %}

{% block head_extra %}
    {% include "_exploitability_style.html" %}
{% endblock %}

{# §0 Identity header — v2 overrides the shell's generic chrome (which would
   otherwise show "Scope: Portfolio · 0 records"); v1 falls back to the default. #}
{% block briefing_header %}
{% if buckets %}
    {% include "_default_logo.html" %}
    <span class="meta">
        <span class="exp-identity">
            <span class="exp-identity-name">{{ subject.scope_descriptor | default('Exploitability Report') }}</span>
            <span class="exp-identity-meta">
                {% if subject.project_name %}{{ subject.project_name }}{% endif %}
                {% if subject.version_label %}<span class="exp-dot">·</span>{{ subject.version_label }}{% endif %}
                {% if subject.folders %}<span class="exp-dot">·</span>{{ subject.folders | map(attribute='name') | join(', ') }}{% endif %}
                {% if subject.platform %}<span class="exp-dot">·</span>{{ subject.platform }}{% endif %}
                {% if record_count is not none %}<span class="exp-dot">·</span>{{ record_count }} findings{% endif %}
                {% if subject.generated_at %}<span class="exp-dot">·</span>Prepared {{ subject.generated_at }}{% endif %}
                {% if subject.report_id %}<span class="exp-dot">·</span>{{ subject.report_id }}{% endif %}
            </span>
        </span>
    </span>
{% else %}
    {{ super() }}
{% endif %}
{% endblock %}

{% block hero %}
<div class="hero" data-fs-section-title>
    <div class="eyebrow">Exploitability Evidence</div>
    <h1>Exploitability Report</h1>
    {% if buckets %}
    <p class="deck">{{ subject.scope_descriptor | default('') }}{% if subject.platform %} — {{ subject.platform }}{% endif %}</p>
    {% else %}
    <p class="deck">
        Verified {{ cover.N | default(0) }} of {{ cover.M | default(0) }} findings
        in {{ cover.scope_label | default('scope') }}; the remaining
        {{ (cover.M | default(0)) - (cover.N | default(0)) }} are untested, not cleared.
    </p>
    <p class="exp-cover-meta">
        Shareable briefing · Catalog {{ cover.catalog_version | default('—') }} ·
        Agent {{ cover.agent_version | default('—') }} ·
        Generated {{ cover.generated_at | default(generated_at) | default('—') }}
    </p>
    {% endif %}
</div>
{% endblock %}

{% block sections %}
{% if render_mode == 'fragment' %}{% include "_exploitability_style.html" %}{% endif %}
{% import "_exploitability_macros.html" as exp with context %}
{% if buckets %}
    {# §1 Decision summary. #}
    {{ exp.decision_summary(summary, bucket_counts) }}

    {# §2 Must-fix · §3 Cleared · §4 Inconclusive · §5b Could-not-assess. #}
    {{ exp.card_section(buckets, 'exploitable', 'Must-fix — proven exploitable', mode) }}
    {{ exp.card_section(buckets, 'not_affected', 'Proven not exploitable', mode) }}
    {{ exp.card_section(buckets, 'inconclusive', 'Tested, inconclusive', mode) }}
    {{ exp.card_section(buckets, 'verifier_failed', 'Could not be assessed', mode) }}

    {# §5 Affected by version — compact table, not cards. #}
    {% set ver = buckets.get('affected_by_version') or [] %}
    {% if ver %}
    <section class="exp-bucket">
        <h2 class="exp-bucket-title">Affected by version <span class="exp-bucket-count">{{ ver | length }}</span></h2>
        <p class="exp-proof">These were not individually pen-tested — the on-device version predates the upstream fix. Remediate by the upgrade in the decision summary above.</p>
        {{ exp.version_table(ver) }}
    </section>
    {% endif %}

    {# §6 Method & honesty notes. #}
    <div class="exp-notes">
        <strong>How to read this.</strong>
        <ul>
            <li><strong>Proven exploitable</strong> — a dynamic PoV produced a real crash/fault under emulation; reproduce with <span class="exp-mono">replay_pen_test &lt;bundle_id&gt;</span>.</li>
            <li><strong>Proven not exploitable</strong> — a sealed verdict (backport match, absent code path) or a decisive reachability/precondition argument. Confidence is shown as a trust tier.</li>
            <li><strong>Tested, inconclusive</strong> — the pen-test ran but a clean verdict could not be responsibly sealed; we do not convert "couldn't prove it" into "safe."</li>
            <li><strong>Affected by version</strong> — the version fact settles applicability; pen-testing would not change the answer.</li>
            <li>No platform VEX has been applied from these results yet — that is a separate, gated step.</li>
        </ul>
    </div>
{% else %}
    {% if cards %}
        {% for card in cards %}{{ exp.verdict_card(card, mode) }}{% endfor %}
    {% else %}
        <p class="exp-empty">No verdict records in scope.</p>
    {% endif %}
{% endif %}
{% endblock %}

{% block methodology %}
{% if not buckets %}
<div class="exp-methodology">
    <strong>What the verifier does.</strong>
    The CVE Evidence Verifier attempts to prove whether each finding is actually
    exploitable in the built artifact — running static dataflow, symbol scans,
    and dynamic traces under emulation — and seals every verdict with a
    replayable evidence bundle. Each card above can be reproduced byte-for-byte
    with <span class="exp-mono">replay_pen_test &lt;bundle_id&gt;</span>.
</div>
{% endif %}
{% endblock %}