[1jovansimon]

Change

Add optional patchwrk scan <project> --html <new-report.html> reporting. The self-contained dashboard prioritizes supported findings, source references, uncertainty and manual next steps, with native expandable evidence and technical details. --json --html keeps existing JSON stdout unchanged.

The founder approved desktop/mobile presentation. The README and report guide describe the optional feature, status meanings, privacy omissions and output-failure limits. No current Cloud service is implied.

Scope and safety

• Existing discovery, compatibility evaluation, four historical catalog records, terminal/JSON schemas, dependencies/lockfile, MIT attribution, security policy and CI definitions are unchanged.
• Escaped text, restrictive hashed-CSS CSP, no JavaScript/external assets/telemetry, no automatic browser opening, and a privacy-minimized projection. Root-relative labels/metadata still require private review before sharing.
• Explicit new-file-only HTML output, private permissions and symlink/identity checks; never overwrite. Portable Node checks do not eliminate hostile ancestor replacement, and interrupted writes can leave incomplete files. These residual behaviors are documented and tested.
• No monitoring, refreshed intelligence, advanced impact analysis, repairs, customer-patch verification, GitHub repair PRs, history/comparison, accounts or billing.
• Only Scanner source, tests, build/archive verification and report documentation are included. The ignore-rule exception keeps the artifact writer source trackable while generated reports remain ignored.

Local validation

Node 24 / pnpm 11.25.0:

• pnpm lint, pnpm typecheck, pnpm test: 393 tests across 12 files passed.
• pnpm build, pnpm benchmark, pnpm package:check: passed. Benchmark is 12 synthetic cases with known unsupported misses, not real-world accuracy evidence.
• pnpm beta:pack and pnpm beta:verify: passed; actual empty-cache offline installation with lifecycle scripts disabled, parent-module resolution and common Node network transports blocked. Installed CLI HTML/CSP/privacy, no-overwrite, JSON equality and target immutability checks passed.
• Injection/malicious filenames, unknown/partial/empty results, filesystem races/interruption, coverage, semantic contrast, responsive CSS and native disclosures covered by regression tests.

Ubuntu/macOS CI must pass on this commit before founder merge review. Automated browser/assistive-technology verification was unavailable locally; static accessibility checks are not a claim of complete browser accessibility verification. No merge, npm publication or release is requested by this PR.