make scanner UI compact and evidence-focused

Author: Karim Baidar

README.md

@@ -9,7 +9,7 @@
 [Static Pages mirror](https://karimbaidar.github.io/false-success-lab/) |
 [Core package: agent-consistency](https://github.com/karimbaidar/agent-consistency)
 
-Scan your AI workflow repo for unverified completion risks.
+Stop false "done" before it ships.
 
 False Success Lab is the interactive developer lab for `agent-consistency`.
 It helps you explore false-success risks in AI workflows and see how
@@ -43,7 +43,8 @@ the completion claim.
 
 ## What you can do in the lab
 
-- Scan public repos for false-success risk.
+- Scan public repos for false-success risk, with repo-fit confidence instead of
+  fake certainty.
 - Import local scan reports without giving the browser filesystem access.
 - Run built-in false-success scenarios.
 - Compare naive vs protected behavior.
@@ -69,9 +70,10 @@ https://github.com/org/repo
 
 The FastAPI backend calls the scanner exposed by the installed
 `agent-consistency` package, downloads the public repo to a temporary directory,
-and returns a false-success report card plus Markdown output. If the backend is
-running with an older `agent-consistency` package that does not expose the
-scanner yet, it returns a clear `503` instead of pretending a scan happened.
+and returns a false-success report card plus Markdown output. The scanner accepts
+any public GitHub repo, but reports whether the repo looks like an
+agentic-workflow repo, workflow-adjacent repo, or general code. Weak matches are
+shown as possible risks that need review.
 
 ### Local Report Import
 
@@ -135,8 +137,8 @@ report cards, proof trails, and copyable fixes.
   the demo lightweight and deterministic.
 - **Lab backend:** validates public scan requests, calls the scanner, and runs
   the refund scenario through the real workflow path where available.
-- **Scanner:** reads source code and returns report-card metrics, findings,
-  severity, confidence, missing evidence, and suggested fixes.
+- **Scanner:** reads source code and returns repo applicability, grouped
+  findings, severity, confidence, missing evidence, and suggested fixes.
 - **Verified action / outcome gate:** blocks or reviews unverified completions
   before customer-visible claims continue.
 - **Verifier packs:** scenario-specific checks for the expected result, such as
@@ -227,11 +229,9 @@ still have duration and resource limits, so very large repository scans may need
 the local CLI path. The UI stays honest: if the backend is unavailable, it shows
 static demo mode and still supports local report import and built-in scenarios.
 
-The hosted backend currently installs `agent-consistency` from the pinned public
-GitHub commit in `requirements.txt`, aligned with the current scanner-enabled
-`agent-consistency` 0.3.2 source. After PyPI is confirmed to have the same
-scanner APIs, switch the dependency back to a PyPI range such as
-`agent-consistency>=0.3.2,<0.4.0`.
+The hosted backend installs `agent-consistency>=0.3.5,<0.4.0` from PyPI. That
+version includes repo applicability, grouped findings, raw exposure, and
+conservative low-confidence wording for weak matches.
 
 To deploy the backend:
 

docs/STATE.md

@@ -25,6 +25,9 @@ false-success workflow classes.
 - UI now renders report-card metrics, confidence, top findings, missing
   evidence, suggested fixes, proof trail, receipt JSON, and copyable Python,
   LangGraph, and tool-wrapper fixes.
+- Scanner UI now uses the stronger `agent-consistency` 0.3.5 scan shape:
+  repo applicability, grouped risk findings, raw exposure, and conservative
+  low-confidence wording for weak matches.
 - README, contribution, security, governance, trademarks, DCO, issue templates,
   and scenario contribution docs were added or updated.
 - README now embeds the repo-local architecture image at
@@ -37,9 +40,7 @@ false-success workflow classes.
   `https://karimbaidar.github.io/false-success-lab/`.
 - Backend deployment target moved to Vercel. The free Vercel API URL is
   `https://false-success-lab-api.vercel.app`.
-- The hosted backend currently uses a pinned public GitHub dependency for
-  `agent-consistency` because PyPI Trusted Publishing has not yet authorized
-  the scanner-enabled package upload.
+- The hosted backend uses `agent-consistency>=0.3.5,<0.4.0` from PyPI.
 
 ## Decisions
 
@@ -64,6 +65,9 @@ false-success workflow classes.
   must run through the CLI and paste/upload flow.
 - Do not claim static scans prove safety. They find configured patterns and
   should feed review or runtime gate work.
+- The scanner can accept any public repo, but it should frame general-code
+  results as low-applicability review prompts. Its strongest signal is for
+  agentic and workflow-heavy repos.
 - Keep refund as the flagship scenario, not the whole product identity.
 - The GitHub repository has moved from `agent-consistency-refund-demo` to
   `false-success-lab`. Keep old-name references only when describing migration

pyproject.toml

@@ -6,7 +6,7 @@ version = "0.3.0"
 description = "Interactive app for false-success scenarios and scanner report cards."
 requires-python = ">=3.9"
 dependencies = [
-    "agent-consistency @ git+https://github.com/karimbaidar/agent-consistency.git@10d1616b2a6e8a178b8ee2f8d8212d3cf552498d",
+    "agent-consistency>=0.3.5,<0.4.0",
     "fastapi>=0.115,<0.129",
     "uvicorn>=0.30,<0.40",
 ]