feat(pdf): quote remediation on the report cover, priced from its findings

[ralyodio]

Puts a "Want us to fix this for you?" offer at the top of every audit PDF. The price is estimated from that report's own findings rather than being a flat figure — billed at $100/hour, split into the two kinds of work:

• AI-assisted — metadata, schema, alt text, template variables, placeholder copy, dead links. The same class of change the GitHub auto-fix agent already opens PRs for.
• Manual — DNS/registrar records, infra and performance work, and anything needing facts only the client has: real metrics, customer quotes, product screenshots, positioning calls.

How it prices

lib/audit/quote.ts maps each check_key to an hours-per-occurrence pair through ordered rules, so a content-heavy report prices differently from a markup-heavy one of the same size. A warn costs 0.6 of a fail. Per-page slop findings are cheap; shared-template fixes (slop.systemic.*) cost more, so the quote reflects "fix the template once" instead of "fix thirty pages".

Guardrails:

• Fixed baseline (intake, plan, verification re-scan, handoff) so a nearly-clean site still quotes enough to cover confirming it's clean
• 120-hour ceiling — past that it's a rebuild, so it flags for a scoping call and prints $X,XXX+ rather than an absurd number
• Dedupe by check_key, worst status wins — a consolidated scan-run PDF carries one findings set per engine and several engines flag the same defect. A missing meta description is one fix whether one engine noticed or five did. Without this the same work was billed per-engine.
• Non-billable keys — rec.*, todo.*, slop.score, slop.coverage, crawl.* restate or summarise defects counted elsewhere

Calibration against live reports

Report	Score	Quote	Hours (AI / manual)
crawlproof.com	58	$2,500	24.5h (10.5 / 14)
news.ycombinator.com	38	$4,100	41h (16.5 / 24.5)
example.com	37	$4,400	44h (16.5 / 27.5)
HN, Slop Score only	—	$1,800	18h (9.5 / 8.5)

Where it renders

On the cover via htmlDocument, so it reaches all three PDF paths: the per-engine email, the consolidated scan-run email, and the on-demand /pdf endpoint (which now accepts a quote in its payload; the app route computes it from audit_findings). The lookup is best-effort — if it fails the PDF still renders, just without the offer.

Verification

21 new tests cover classification, dedupe, guardrails and rounding. Full suite 493 passing, tsc --noEmit clean, production build clean. I also rendered a real PDF and inspected the cover page rather than trusting the markup.

Copy is in one place (quoteBlock in lib/markdown.ts) and the rate/target are constants (HOURLY_RATE_USD, TARGET_SCORE) if you want to tune the offer.

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.