feat(report): SUMMARY.html — the one page that actually gets forwarded - #10

What

stpa summary writes a one-page SUMMARY.html beside REPORT.html. stpa run now emits both.

REPORT.html is written for the engineers who will fix the findings — ten sections, the full grid, every scenario. Nobody forwards it to a founder. The analysis reached the people who could fix things and stopped at the people who decide whether it gets fixed.

The summary is one sheet: stat row, what is at stake, wave 1, top root causes by leverage. Self-contained, no JavaScript, prints clean, light/dark aware.

The design constraint

A summary is the artifact most likely to be read instead of the report, which makes it the artifact most likely to launder an incomplete analysis into a confident one — the exact failure class this toolkit exists to find.

So every qualifier the report carries, this page carries too, above the numbers rather than in a footnote: not peer-reviewed, sections missing, scope not delivered, cells open, findings unbound. CI asserts the unreviewed banner is present, because that is the one a hurried author would be most tempted to drop.

Both pages render from the same artifacts, so they cannot drift. Every figure is computed; none is narrated.

Two fixes found while building it

• Losses parsed out of 01-scope.md rendered L-1 — — the loss. Stripping the id from the bold half leaves the dash on the text half.
• The hazard reach column read only linksTo, which no finding in the worked example records — so it showed 0 beside findings whose own statements say "leading to H-3". That is not a missing number, it is a wrong one. It now falls back to the hazard ids the statements name, and the table states which source produced the column. RenderReport.ts §4 still has the original behaviour — same six lines, same all-zero column. Left alone here to keep this PR to one change; worth a follow-up.

Verification

• Full CI smoke suite passes locally, 6/6, plus the new summary step.
• New CI step asserts: renders, non-empty, no external src/href, no <script>, carries the NOT-INDEPENDENTLY-REVIEWED banner, links REPORT.html.
• Negative case: exits 1 with a clean message when there is no grid.json.
• Rendered page verified in real Chrome — header, banner, 5-stat row, losses, hazard table, wave-1 cards, root causes, footer link all correct.
• SUMMARY.html for the worked example is committed alongside the existing REPORT.html.

Not in this PR

stpa run and every Tools/*.ts are broken under Node on Node 25.9.0 — SyntaxError: Cannot use import statement outside a module. The tools are ESM, the repo has no package.json, so Node resolves .ts as CJS; adding {"type":"module"} fixes the tools but breaks the CJS stpa launcher. CI only installs Bun and never invokes ./stpa <subcommand>, which is why #9's "runs on Node or Bun" shipped green. Filed separately.

🤖 Generated with Claude Code