# dossier — Changelog ## v1.0.1 — 2026-06-22 ### Fixed - `exec_summary_section` severity-rollup table label/count index swap. In v1.0.0 the labels iterated `["Critical", "High", "Medium", "Low", "Info"]` but `counts[]` was indexed by `Severity::Info → 0` etc., so a critical finding showed up as "Info: 1" in the table even though the prose paragraph above correctly said "1 critical". Fix: labels are now `["Info", "Low", "Medium", "High", "Critical"]` to match the counts indexing, then `.rev()` reverses the iteration so the table still renders highest-first. - Regression test `exec_summary_table_aligns_label_to_count` pins this behavior. 13 integration tests now pass (was 12). ## v1.0.0 — 2026-06-22 Initial release. Phase 2.2 of the cli.johlem.net consulting layer (jfind → complymap → **dossier** → inciclass → roigen → tiberscope). ### Inputs - `jfind/v1` finding (single document) - `jfind-bundle/v1` (engagement-scoped bundle) - NDJSON `jfind/v1` stream (one finding per line — what credsweep / urlrecon / phishprobe / specter / avwatch emit directly) - JSON array of `jfind/v1` findings - `complymap-gap/v1` matrix (pre-computed gap report) Content-sniffed at load time; no `--input-kind` flag needed. ### Outputs - **HTML** (default) — single-file document with the johlem CSS embedded in ``. A4 page size, 20mm margins, red `#E8350A` brand colour for H1 rules + table headers, grey `#ccc` for HRs + footer rules, Courier 8pt for code blocks, severity-stamped per-finding cards. - **Markdown** — CommonMark, same content as HTML; useful for email / chat / grep / pandoc downstream conversion. - **Document IR** (`dossier-ir/v1`) — the stable JSON intermediate the spec calls for. Operators with their own ReportLab / Typst / LaTeX pipeline can pipe `dossier ir bundle.json | their-renderer`. PDF: pipe the HTML through `wkhtmltopdf`, `weasyprint`, or a browser's print-to-PDF. Native Rust PDF arrives in v1.1. ### Subcommands ``` dossier render --template [--format html|md|ir] [-o report.html] [--signed] dossier toc # list templates + ready/stub status dossier ir --template # IR-only shortcut for render -F ir ``` ### Templates (5 total — 3 ready, 2 stubs for v1.1) | Template | Status | Sections | |---------------------|------------|----------| | `gap-assessment` | **ready** | cover · exec summary · scope · methodology · gap matrix · per-finding cards · appendix (chain of custody) | | `pentest` | **ready** | cover · exec summary · scope · methodology · per-finding cards · recommendations | | `incident` | **ready** | cover · exec summary · DORA Art. 18 classification checklist · DORA Art. 19 notification clock · per-finding cards | | `phishing-takedown` | stub (v1.1) | accepts `--template`, errors cleanly with `not yet implemented` | | `roi-summary` | stub (v1.1) | accepts `--template`, errors cleanly (depends on `roigen` from Phase 3) | ### Style spec (matches consulting-layer spec §3.2) A4 paper · 20mm margins · body text `#0a0a0a` · grey `#ccc` rules · H1 15pt bold + red `#E8350A` HR · H2 13pt · H3 11pt · code Courier 8pt on `#f5f5f5` · tables with `#E8350A` header + white text and alternating `#f9f9f9` / white rows · cover 24pt title + 12pt subtitle + red HR + 9pt meta + PageBreak · header / footer grey HRs with "Confidentiel" + page number. ### `--signed` flag When passed, the cover gets a `Bundle SHA-256:` line carrying the hex digest of the input bytes — for chain-of-custody. Cryptographic signing (Ed25519 over canonical bundle bytes) is the job of `jfind sign`; dossier only echoes the hash on the cover. ### Suite integration - Reads jfind/v1 + complymap-gap/v1 directly (no glue script needed). - Library crate (`dossier`) + CLI binary (`dossier`). - 12 integration tests (CLI behaviour, all three template renders, HTML + Markdown + IR formats, complymap-gap input, signed cover, toc). Zero compiler warnings. - Suite-wide exit codes per `SUITE_STANDARDS.md` §1: 0 ok / 2 usage / 3 runtime / unknown-template / parse. - Mandatory tagline footer on every `--help` and at the end of every rendered HTML / Markdown document. - `--full` extended help (suite convention). ### Acceptance gate (Phase 2.2) `dossier render --template gap-assessment --signed` produces an HTML document that: 1. Has the johlem CSS embedded (red `#E8350A`, A4 page-size, alternating row colours). 2. Contains the cover, executive summary, scope, methodology, gap matrix table, per-finding cards, and an appendix. 3. Embeds the `Bundle SHA-256:` line on the cover when `--signed` is passed. 4. Renders 17 KB of HTML for a 3-finding sample bundle in under 100 ms. Verified end-to-end against the full pipeline (`credsweep ... > a.ndjson; ... | jfind merge | complymap map | dossier render -F html --signed`). ### Deferred to v1.1 - Native Rust PDF output. Current operator workflow: `dossier render -F html -o report.html && wkhtmltopdf report.html report.pdf`. - `phishing-takedown` template (depends on `openclaw` artefacts). - `roi-summary` template (depends on `roigen` — Phase 3). - Per-control "detailed evidence" sub-section under each gap matrix row. - Configurable colour palette (Cargo feature for white-label deployments). - Embedded charts (severity rollup pie, framework coverage bar) — currently text tables only.