progress.txt

F005 - Engineering Baseline: Hooks + CI + Security Scanning [PASSES]
- TypeScript + Vite build pipeline for Chrome MV3 extension
- ESLint (flat config) + Prettier with pre-commit hook (format, lint, typecheck)
- Pre-push hook runs unit tests
- GitHub Actions CI: lint, typecheck, test, build, package artifact
- CodeQL security scanning (PR + weekly schedule)
- Release workflow with signed/hashed artifacts on tag push
- Vitest with v8 coverage at 50% threshold floor
- Extension scaffold: manifest.json, popup, content script, background service worker
- Data-driven rule definitions: field-groups.ts, claim-keywords.ts
- Core types: ScanResult, FieldResult, ClaimFlag, ProductCategory
- 13 passing unit tests across 3 test files

F010 - Extension Shell UI [PASSES]
- Popup HTML with header, category selector (5 categories), Scan button, status area, results placeholder, disclaimer footer
- Styled popup CSS (360x480px, blue scan button, status states for scanning/error/success)
- popup-ui.ts: pure testable functions (getSelectedCategory, setStatus, setScanEnabled)
- popup.ts: wires DOM events, sends SCAN message to content script via chrome.tabs.sendMessage
- 7 new unit tests for popup UI logic (20 total passing)

F020 - DOM Snapshot Capture [PASSES]
- snapshot.ts: captureSnapshot() extracts URL, title, timestamp, meta tags, text content, and SKU hints
- extractMetaTags: parses meta[name], meta[property], meta[itemprop] from the DOM
- extractTextContent: clones body, strips script/style/noscript/svg/iframe, collapses whitespace
- extractSkuHints: regex-based extraction for SKU, ASIN, UPC, EAN, ISBN, Item/Model/Part numbers with deduplication
- Content script handles SCAN message and returns snapshot to popup
- jsdom added for DOM-based testing
- 19 new unit tests for snapshot module (39 total passing)

F030 - Rule Engine v1 [PASSES]
- engine.ts: runRules() orchestrates field evaluation and claim detection against a PageSnapshot
- detectField: checks meta tags (high confidence 0.9) then text patterns (0.7) for each compliance field
- evaluateFields: runs all 12 field definitions from field-groups.ts against snapshot, returns FieldResult[]
- detectClaims: case-insensitive keyword matching against claim-keywords.ts with surrounding context extraction
- FIELD_SEARCH_PATTERNS: regex map for all 12 fields (product_name, brand, materials, warnings, etc.)
- META_KEY_MAP: Open Graph / structured data key lookups for meta-based detection
- 20 new unit tests for engine module (59 total passing)

F040 - Risk Score Model [PASSES]
- scoring.ts: calculateRiskScore() produces explainable breakdown from fields and claims
- calculateFieldPenalties: required fields penalized at 10 pts, optional at 3 pts when missing
- calculateClaimPenalties: high=8, medium=5, low=2 pts per unique unsubstantiated claim (deduplicated)
- calculateMaxFieldScore: computes theoretical max from field definitions
- RiskScoreBreakdown type with fieldPenalties and claimPenalties arrays for explainability
- Updated ScanResult type with riskBreakdown field
- New types: FieldPenalty, ClaimPenalty, RiskScoreBreakdown exported from types/index.ts
- 18 new unit tests for scoring module (78 total passing)

F050 - Evidence Clipper [PASSES]
- clipper.ts: pure functions for creating and managing evidence clips
- createClip: builds EvidenceClip from selected text with context, URL, timestamp, and optional field/claim association
- extractContext: extracts surrounding text (configurable radius) with ellipsis for truncation
- addClip/removeClip: immutable list operations for managing clip collections
- getClipsForField/getClipsForClaim: filter clips by associated field key or claim keyword
- EvidenceClip type added to types/scan.ts with id, text, context, url, timestamp, fieldKey?, claimKeyword?
- ScanResult updated with evidence: EvidenceClip[] array
- Content script handles CLIP_EVIDENCE message: captures window selection, creates clip, returns to popup
- 21 new unit tests for clipper module (100 total passing)

F060 - Threadmark JSON Export [PASSES]
- threadmark.ts: pure functions for building and serializing Threadmark-compatible JSON bundles
- buildThreadmarkBundle: packages ScanResult into ThreadmarkBundle with version, generator, export timestamp, scan metadata, fields, claims, evidence, and risk summary
- serializeBundle: pretty-prints bundle as 2-space indented JSON string
- generateFilename: creates hostname+date based filename (e.g. threadmark-example.com-2026-02-28.json)
- ThreadmarkBundle type added to types/scan.ts with scan metadata, riskSummary (nullable), and all scan data
- 14 new unit tests for export module (114 total passing)

All MVP features complete (F005-F060).