feat: arbiter report — HTML/PDF audit reports for hummbl.io consulting

[hummbl-dev]

Summary

New arbiter report command that generates branded, self-contained HTML audit reports for consulting clients. Two tiers: free (lead gen) and paid (full engagement deliverable).

Usage

arbiter report /path/to/client-repo --tier free -o client-free.html
arbiter report /path/to/client-repo --tier paid -o client-paid.html
arbiter report /path/to/client-repo --tier paid --pdf -o client.html

Features

• Free tier: Grade badge, category scores (lint/security/complexity), upgrade CTA with mailto link
• Paid tier: Everything in free + findings table with severity/file/rule, remediation roadmap, stats grid
• hummbl.io design system: Dark theme, JetBrains Mono, cyan accents, print-friendly @media print
• Self-contained: Single HTML file, inline CSS/SVG, no external dependencies
• PDF support: weasyprint for automated PDF, browser print fallback
• XSS-safe: All user content HTML-escaped
• Embedded JSON: <script type="application/json" id="audit-data"> for future dashboard hydration

Deploy workflow

arbiter report ~/client-repos/acme --tier free -o audit/acme.html
cp audit/acme.html ~/hummbl-production/web/audit/acme.html
# → live at hummbl.io/audit/acme

Test plan

• 87 tests pass (78 existing + 9 new)
• Free tier renders with upgrade CTA
• Paid tier renders with findings + remediation
• HTML escaping verified (XSS prevention)
• Visual check in browser

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 562808524b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Escape JSON before embedding it in <script>

report.to_json() is inserted raw into {{REPORT_JSON}}, which is rendered inside <script type="application/json">; if any finding field contains </script> (for example from a crafted filename or analyzer message in an untrusted repo), the browser will terminate the script block early and parse attacker-controlled HTML/JS. This makes the generated report XSS-prone when opened locally or hosted. Please HTML-safe the JSON payload for script embedding (e.g., escape <, >, &, and </script> as Unicode escapes) before substitution.

Useful? React with 👍 / 👎.