fix(worker): make scan.summary reflect all persisted findings, not just the engine's own count

[ecryptoguru]

DRAFT — root-caused while doing the marketing screenshot work in #306. Not blocking that PR (already merged); this is the underlying product bug it surfaced.

The bug

A real Trust Runs screenshot showed:

Engine status: completed. 0 finding(s) reported.          [badge] 39 findings

Both numbers were individually correct for what they measured — which is exactly the problem: nothing in the copy explains why they disagree, so it just looks broken.

Root cause

Two independent pipelines compute "how many findings" for the same scan:

• The frozen summary text (output-parser.ts:824, parseEngineOutput) is built from vulnerabilities.length — parsed only from the raw agentic engine's vulnerabilities.json artifact.
• The badge (scan-service.ts:347, _count.findings) is a live count of Finding rows actually persisted, which come from orchestratorResult.allFindings — the combined set across the engine, SCA, secrets, agent-config, and URL scanners, after false-positive filtering and dedup (scanner-orchestrator.ts:56-67).

run-scan.job.ts:1269 persisted the engine-only text to scan.summary after the combined set was already persisted, even though the correct total (persistedFindings.length) was sitting in scope one line above the findings_persisted event that already uses it.

Why this is bigger than a UI badge

scan.summary is read verbatim in four places, not one:

• Trust Runs list + scan detail page (apps/web)
• The private assurance report and shared report view — an exec/client-facing report's "Summary" row would say "0 finding(s) reported" while listing 39 findings
• Scan-completion notifications — the body embeds the wrong summary right next to a title that already correctly says "39 findings" (notifyScanCompleted's 4th arg is persistedFindings.length, already correct) — so the same message contradicts itself

The fix

Scoped entirely to run-scan.job.ts. output-parser.ts is untouched — parseEngineOutput is a correctly-named pure parser of the engine's own artifact, and changing its meaning would be a bigger, less obviously correct change.

Built scanSummary once, right after persistedFindings is known:

• If persistedFindings.length === engineResult.output.findingCount (the common case — nothing else contributed, nothing filtered) — pass the engine's text through unchanged.
• If they disagree — append the real count: "Engine status: completed. 0 finding(s) reported. 39 finding(s) retained after all scanner layers and deduplication."

All four downstream writes (prisma.scan.update, the write completeScanWithScore performs, notifyScanCompleted's body, and the job's return value) now use this one corrected value instead of four separate references to the engine-only string.

No scoring risk: completeScanWithScore's summary parameter is display-text only (score-service.ts:244) — it never touches computeScore, the breakdown, or the ScoreSnapshot itself, all of which query the live Finding table independently. This does not touch the public-scorecard allowlist or the score model.

Tests

Traced every existing assertion in run-scan.job.test.ts by hand: the file's default mocks always have persistFindings resolving to the same count as the mocked findingCount (usually both 0), so the corrective branch never fires for any existing test — zero existing expectations changed. Added two new tests:

1. Reproduces the exact bug shape (engine says 0, three scanner-layer findings persist) and asserts the corrected text at all four call sites.
2. Guardrails the passthrough: when the counts already agree, the summary must not grow a second sentence.

Verification

Sandbox has no node_modules and npm returns 403, so vitest/tsc/eslint could not run locally. I traced every call site of engineResult.output.summary, every consumer of scan.summary across the repo, and every existing test assertion in the affected file by hand instead. CI on this PR is the execution gate — will report back once it's green.

Summary by CodeRabbit

• Bug Fixes
  • Scan completion summaries now reflect the total retained findings when they differ from the engine-reported count.
  • Updated summaries are consistently used for scan results, completion scoring, and notifications.
  • Existing summaries remain unchanged when finding counts match.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 03fb8d95-433d-4940-a632-4bc3c028c3d7

📥 Commits

Reviewing files that changed from the base of the PR and between 7a271c1 and 1c03018.

📒 Files selected for processing (2)

• apps/worker/src/jobs/run-scan.job.test.ts
• apps/worker/src/jobs/run-scan.job.ts

---

📝 Walkthrough

Walkthrough

The scan job now reconciles engine summaries with retained finding counts. It persists, scores, notifies, and returns the consolidated summary. Tests cover differing counts and unchanged matching counts.

Changes

Scan summary reconciliation

Layer / File(s)	Summary
Consolidate and propagate scan summaries apps/worker/src/jobs/run-scan.job.ts	The job creates scanSummary when retained findings differ from the engine count. It uses this summary for persistence, completion scoring, notifications, and the returned result.
Validate summary reconciliation apps/worker/src/jobs/run-scan.job.test.ts	Tests cover retained findings from SCA, secrets, and agent-configuration scanners. A guardrail test confirms unchanged summaries when counts match.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• ecryptoguru/lyrashield-ai#79: Both changes update the scan job and tests for scan outcome behavior.
• ecryptoguru/lyrashield-ai#109: Both changes update the scan execution flow in run-scan.job.ts.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/scan-summary-finding-count

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}