# Day 4 — Production-Blocking Bug Fixes (2026-05-19)

W1 validation sprint Day 4. 3 production-blocking bugs from 5/16 Day 1
findings were unfixed for 3 days while the prior session focused on
outreach work. This day fixed them.

## Bugs fixed

### Bug 2 — panguard-scan --output silently dropped (HIGH)

**Symptom:** `panguard-scan code --output xxx.pdf` exited 0, said
"No security issues found." but wrote no file.

**Root cause (two issues):**

1. The `code` subcommand action body never consumed `options.output`. The
   --output flag was declared but ignored.
2. Commander 12 parent/subcommand option-name collision: the root program
   also declares `--output` (default scan target), so the parent's option
   consumed any `--output` after the subcommand name. Reproduced in a
   10-line isolated commander script.

**Fix:**

- `program.enablePositionalOptions()` on the root program — now parent
  options must come BEFORE subcommand name; everything after is parsed
  by the subcommand.
- New `src/report/code-scan-pdf.ts` (200 lines): focused PDF generator
  for SAST findings. Does NOT reuse the heavy `generatePdfReport` which
  is built around host-scan ScanResult (discovery/network/services that
  don't apply to pure source-code scans).
- Code subcommand action writes the PDF (or exits 2 on generator error).

**Verify:** Clean scan on `packages/core/src` now writes valid 2018-byte
PDF (1 page, "Clean Scan — No Findings" cover) and prints
"Report saved to: ..."

**Commit:** `15ecc071`

### Bug 3 — panguard-report HTML/PDF silent fail (CRITICAL)

**Symptom:** `panguard-report generate --format html` exited 0 with
"Report generated successfully" — output-dir empty. Customer paying for
HTML report got an empty filesystem.

**Root cause:** CLI handler in `src/cli/index.ts` had explicit branches
for `'pdf'` and `'json'` only. `'html'` fell to the `else` branch which
prints summary text to stdout (no file written) then prints the success
message anyway.

**Fix:**

- `ReportFormat` type expanded: was `'pdf' | 'json'`, now
  `'pdf' | 'json' | 'html'`.
- New `src/generator/html-generator.ts` (350 lines): single-file HTML
  with inline CSS, no external assets. Auditors can open offline, email
  the file, or browser-print to PDF.
- CLI wire: `format === 'html'` branch calls `generateHTMLReport` and
  prints the actual file path.

**Verify:** ISO 27001 assessment renders 26315-byte HTML with 5 findings,
30 controls (21 passed / 5 failed / 4 partial), 77% compliance score,
inline CSS, print-friendly. Severity badges + status badges + control
matrix all rendered correctly.

**Commit:** `96efa330`

### Bug 4 — panguard-skill-auditor no CLI (MEDIUM)

**Symptom:** Package shipped library-only, no `bin` entry. SKU A delivery
could not demonstrate the skill-audit step without an ad-hoc wrapper.

**Fix:**

- New `src/cli.ts` (170 lines): parses `--dir / --json / --fail-on /
--fleet`. `--fleet` walks parent dir and audits each subdirectory
  containing `SKILL.md`. Exits 1 if `--fail-on` threshold met.
- `package.json` bin entry: `panguard-skill-audit` → `./dist/cli.js`

**Verify:** Real-world test on `skills/panguard-skill-auditor/` —
7 checks, 12 findings, Risk: CRITICAL (score 100). Matches library API.

**Commit:** `efd0d9f2`

## Bug 1 — exit code 1 on clean scan (HIGH, prior session)

Status: Already fixed by prior session before 2026-05-19. Verified clean
scan now exits 0. No additional work needed.

## SKU readiness after Day 4 fixes

| SKU                   | Before Day 4       | After Day 4                                    | Production-ready?                           |
| --------------------- | ------------------ | ---------------------------------------------- | ------------------------------------------- |
| A. Static Audit       | ⚠️ 2 bugs blocking | ✓ all 3 bugs fixed                             | YES                                         |
| B. Runtime Deployment | untested           | ✓ smoke test pass (`scan` detects 9 platforms) | basic — daemon/service modes not yet smoked |
| D. Compliance Report  | ⚠️ 1 CRITICAL bug  | ✓ HTML+PDF+JSON all working                    | YES                                         |
| E. Rule Migration     | ✓ working          | ✓ still working                                | YES                                         |

## End-to-end dogfood — all 4 SKUs

Real artifacts written to `/tmp/prod-audit-output/sku-final/`:

```
RPT-202605-ISO-0001.html      26317 B   SKU D — bilingual HTML report
RPT-202605-ISO-0001.pdf       14845 B   SKU D — bilingual PDF report
RPT-202605-ISO-0001.json      39133 B   SKU D — machine-readable
sca-scan.pdf                   2019 B   SKU A — code-scan clean PDF
skill-audit.json               6885 B   SKU A — skill-audit JSON
```

All 5 files valid, non-zero, openable.

## Decision impact

Prior 5/16 W1 plan said "Cannot promise SKU A or SKU D delivery to clients
TODAY. Need 2-3 days bug fix work first." Day 4 closed that loop —
SKU A and SKU D are ready for client delivery.

SKU E (Migrator) remains the most production-ready (also benefits from
v3.0 multilingual PROMPT v2 enrichment landed earlier this week).

SKU B (Runtime) basic scan works; full daemon/install lifecycle should
be smoked before promising it to a Pilot customer who wants 24/7 runtime
detection.

## What's still NOT production-grade

- Customer Pilot SOW + DPA + NDA templates: not started
- Demo environment URL (`demo.panguard.ai`): not deployed
- 5-min demo recording: not recorded
- SIG Lite + CAIQ self-assessment: not written
- SOC 2 Type 1: not started (Phase 1B blocker)

Per Master Plan v2 (砍半 18-task version):

- Day 5+: continue Phase 1A Lane work after this validation gate
- Engineer ATR engine work landed Day 1-2 (v3.0.0-alpha.0 with 414 tests)
- App rule drill-down committed (04bf72bd), i18n 6 locales (19d6265f)
- pnpm override link to ATR v3.0 (93436000)
