# HTML Report Glossary — The Terms Behind Publishing, Sharing and Reviewing Reports

Canonical: https://commareports.com/glossary
Published: 2026-09-11

> Plain definitions for the vocabulary that shows up when a report has to leave your machine: artifact retention, SARIF, self-contained HTML, CSP, presigned URLs, MCP and the rest.

# Glossary

The vocabulary that turns up the moment a generated report has to leave
the machine that made it. Each entry is a definition first, then the
part that actually bites in practice.

## Report formats and outputs

- [HTML report](/glossary/html-report) — what one is, and why it is never just one file
- [Self-contained HTML](/glossary/self-contained-html) — the single-file export mode, and its ceiling
- [Code coverage](/glossary/code-coverage) — line, branch, statement, and what a percentage hides
- [JUnit XML](/glossary/junit-xml) — the interchange format with no specification
- [SARIF](/glossary/sarif) — the OASIS standard for static analysis findings
- [SBOM](/glossary/sbom) — CycloneDX, SPDX, and what a bill of materials is for
- [Flame graph](/glossary/flamegraph) — why the x-axis is not time
- [Mutation testing](/glossary/mutation-testing) — the coverage metric that can actually fail
- [Flaky test](/glossary/flaky-test) — the definition, and why the report matters more than the fix
- [.ipynb](/glossary/ipynb) — notebook files, and what survives an HTML export

## CI and storage

- [Build artifact](/glossary/build-artifact) — what CI keeps, and on whose terms
- [Artifact retention](/glossary/artifact-retention) — the four mechanisms that delete your link
- [Static site hosting](/glossary/static-site-hosting) — serving files with no server
- [Presigned URL](/glossary/presigned-url) — signed, time-boxed object access
- [MIME type](/glossary/mime-type) — the header that decides render versus download

## Browser behaviour

- [Same-origin policy](/glossary/same-origin-policy) — and the opaque `file://` origin
- [Content Security Policy](/glossary/content-security-policy) — what the host allows a page to load
- [Mixed content](/glossary/mixed-content) — HTTP subresources on an HTTPS page
- [Data URI](/glossary/data-uri) — inlining assets, at a 33% tax
- [iframe sandbox](/glossary/iframe-sandbox) — running untrusted HTML safely

## Agents

- [Model Context Protocol (MCP)](/glossary/model-context-protocol) — how an agent gets tools
- [Agent artifact](/glossary/agent-artifact) — the output an agent produces that outlives its session

## Why these terms cluster together

Almost every entry above is a step on the same path. A tool generates a
directory of HTML. CI stores it as an **artifact** under a **retention**
policy. Someone links it. The link 404s, or the page opens blank because
the **origin** was `file://`, or it downloads instead of rendering
because the **MIME type** was wrong, or the charts are missing because
**CSP** refused the CDN.

The terms are the failure modes, named.

Publishing the whole output directory to an address you own collapses
most of them: assets travel with the entry file, the origin is a real
HTTPS origin, the `Content-Type` is correct, and the link does not have
an expiry date attached to someone else's storage policy.

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited
revision history.

**[Publish a report that opens for everyone →](https://commareports.com/)**

### Related

- [Report types](/report-types) — 200+ per-tool publishing guides
- [Troubleshooting](/fix) — when a report breaks after it leaves your machine
- [Publish from CI](/docs/ci) · [Comma by role](/for)