> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrqen.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Reports

> One canonical report, four renderings, and a projection layer that decides what a given viewer receives.

`myrqen session finish` builds one canonical report object and renders it four ways. All
four land in the project you scanned, and none of them require an account.

```
.myrqen/reports/<localReportId>/report.html
.myrqen/reports/<localReportId>/report.json
.myrqen/reports/<localReportId>/report.md
.myrqen/reports/<localReportId>/report.sarif.json
```

## The four formats

<CardGroup cols={2}>
  <Card title="HTML" icon="browser">
    A self-contained page: filter by severity and verification, expand a finding for
    evidence and remediation, copy the fix prompt. No external scripts, stylesheets, or
    fonts — it opens with the network off.
  </Card>

  <Card title="JSON" icon="brackets-curly">
    The canonical `ScanReport`, validated against `schemas/report.schema.json`. This is
    the machine-readable source of truth.
  </Card>

  <Card title="Markdown" icon="markdown">
    For a pull request, an issue, or a wiki.
  </Card>

  <Card title="SARIF" icon="code-branch">
    For code-scanning tooling that consumes SARIF.
  </Card>
</CardGroup>

Verify the HTML is genuinely offline:

```bash theme={null}
grep -c "<script src\|<link .*href\|@import" .myrqen/reports/*/report.html   # 0
```

## What the canonical report contains

`ScanReport` in `packages/contracts/src/domain.ts`, schema version `1.0.0`:

| Field                        | Contents                                                                                                                                                                                                                                               |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `project`                    | Name, workspace kind and name, repository label.                                                                                                                                                                                                       |
| `scan`                       | Requested and resolved effort, the effort profile, start and end instants, duration, agent metadata, host environment, token usage with provenance, the scope (local targets plus authorized external targets), phase records, and the detected stack. |
| `authorization`              | `destructiveActionsAllowed: false`, the prohibited-action list, `externalTargetAuthorization: "exact_origin_only"`, and whether local targets were in scope.                                                                                           |
| `summary`                    | Finding count, per-severity counts, per-verification counts, and candidate, duplicate, and fixed counts.                                                                                                                                               |
| `findings`                   | Every finding, with evidence, corroboration, redacted secret references, status, and fix history.                                                                                                                                                      |
| `coverage` / `coverageAreas` | What was assessed, and how.                                                                                                                                                                                                                            |
| `limitations`                | What was **not** assessed, and why.                                                                                                                                                                                                                    |

<Note>
  `limitations` is not an afterthought. The product's stated position is that silence from a
  scanner is not a clean bill of health, so a report that found nothing still says what it
  covered and what it could not reach.
</Note>

## Token usage is reported with provenance

`tokenUsage.source` is mandatory and is one of:

| Source        | Meaning                                                      |
| ------------- | ------------------------------------------------------------ |
| `exact`       | A real count the host agent reported.                        |
| `estimated`   | An estimate, with `estimator` naming the method and version. |
| `unavailable` | The host could not report it.                                |

An exact count is never fabricated. Where the platform aggregates this, exact and
estimated counts are kept in separate columns and never averaged together.

## The fix prompt

```bash theme={null}
myrqen fix prompt MYR-001
```

Prints a remediation prompt a coding agent can act on, and records that a fix was
suggested. The HTML report has the same thing behind **Copy prompt to fix**. See
[Fix and retest](/guides/fix-and-retest).

## Synced reports and projections

A [synced](/concepts/cloud-sync) report can be opened in the dashboard and shared. What a
given viewer receives is decided **server-side** by a projection policy — never by
client-side hiding.

`ProjectionPolicy` is deliberately a typed, testable structure rather than a programmable
policy language:

```json theme={null}
{
  "version": 1,
  "sections": { "mode": "allow_only", "ids": ["metadata", "summary", "findings"] },
  "findings": { "mode": "allow_only", "ids": ["MYR-001", "MYR-002"], "maxSeverity": "high" },
  "fields": { "evidence": true, "code": true, "reproduction": true },
  "anonymize": false
}
```

| Part        | Effect                                                                                             |
| ----------- | -------------------------------------------------------------------------------------------------- |
| `sections`  | Which of `metadata`, `summary`, `findings`, `coverage`, `limitations`, `methodology` are included. |
| `findings`  | Which findings are included, optionally capped by severity.                                        |
| `fields`    | Masks applied to what remains: `evidence`, `code`, `reproduction`, `remediation`, `metadata`.      |
| `anonymize` | Strips identifying project and account detail.                                                     |

Hidden content is **absent from the payload**, not hidden in it. That holds for the page,
the JSON, and every export format — the export routes resolve the same projection the page
does, so no format is a bypass.

## Report expiry

A synced report has a retention window from its plan
([21 days on free](/concepts/cloud-sync#plan-limits)). When it expires the worker deletes
the body and its stored object, share links stop working, and the report page explains the
expiry. Requests return `REPORT_EXPIRED` (HTTP 410).

Your local files are untouched. That is the point of local-first.

## Encryption at rest

In the hosted service, report bodies are encrypted with `REPORT_ENCRYPTION_KEY` before
they reach object storage, so the store never holds plaintext.
`REPORT_ENCRYPTION_KEY_PREVIOUS` accepts retired keys for **reads only**, which is what
makes key rotation possible — move the old key there when rotating, or every stored report
stops opening.

## Related

<CardGroup cols={2}>
  <Card title="Share a report" icon="share-nodes" href="/guides/share-a-report">
    One URL that renders differently per recipient.
  </Card>

  <Card title="Report export API" icon="code" href="/api-reference/introduction">
    `GET /api/v1/reports/{id}/export/{format}` and the share equivalent.
  </Card>
</CardGroup>