@cat-factory/app 0.243.0 → 0.245.0

package/app/components/outcome/OutcomeSummaryWindow.vue

@@ -19,14 +19,18 @@ import type {
   OutcomeCheckKind,
   OutcomeCheckState,
   OutcomeDisposition,
+  OutcomeSource,
   OutcomeSpecJoin,
   OutcomeVisual,
   RequirementsGap,
+  SourcesGap,
   TestsGap,
   TestsVerdict,
   VisualsGap,
 } from '~/utils/runOutcome'
 import { composeRunOutcome } from '~/utils/runOutcome'
+import { GAP_KEYS } from '~/components/documents/DocumentSyncState.logic'
+import DocumentOriginLink from '~/components/documents/DocumentOriginLink.vue'
 import { REPRODUCTION_STATUS_KEYS } from '~/utils/reproduction'
 import type { RequirementVerdictStatus, TestConcernSeverity } from '~/types/domain'
 import type { TestEnvironment } from '@cat-factory/contracts'
@@ -37,6 +41,7 @@ import MarkdownProse from '~/components/common/MarkdownProse.vue'
 import EmptyState from '~/components/common/EmptyState.vue'
 
 const board = useBoardStore()
+const documents = useDocumentsStore()
 const execution = useExecutionStore()
 const serviceSpec = useServiceSpecStore()
 const ui = useUiStore()
@@ -128,6 +133,10 @@ const TESTS_GAP_KEYS: Record<TestsGap, string> = {
   no_tester_step: 'outcome.tests.gap.no_tester_step',
   tester_not_reported: 'outcome.tests.gap.tester_not_reported',
 }
+const SOURCES_GAP_KEYS: Record<SourcesGap, string> = {
+  run_unavailable: RUN_UNAVAILABLE_KEY,
+  none_linked: 'outcome.sources.gap.none_linked',
+}
 const VISUALS_GAP_KEYS: Record<VisualsGap, string> = {
   run_unavailable: RUN_UNAVAILABLE_KEY,
   no_visual_step: 'outcome.visuals.gap.no_visual_step',
@@ -288,6 +297,47 @@ const checkRows = computed(() =>
   })),
 )
 
+/**
+ * What one linked page's row says about how current the copy the agents read was.
+ *
+ * Four outcomes, and none of them may collapse into another: a named revision to check the work
+ * against, a copy nobody could confirm (a warning about the WORK, not about the platform), a body
+ * with no source to trail, and a deployment that runs no freshness check at all. The last two are
+ * the pair a dash would merge, and they are opposite facts about whether anything is missing.
+ */
+function revisionLabel(freshness: OutcomeSource['freshness']): string {
+  if (!freshness) return t('outcome.sources.unchecked')
+  switch (freshness.status) {
+    case 'confirmed':
+      return t('documents.freshness.revision', { version: freshness.version })
+    case 'not-applicable':
+      return t('outcome.sources.noSource')
+    case 'unconfirmed':
+      return t(GAP_KEYS[freshness.reason])
+    default:
+      return exhaustiveFreshness(freshness)
+  }
+}
+
+/** Compile-time totality: a new verdict member fails the build rather than rendering a blank. */
+function exhaustiveFreshness(freshness: never): string {
+  return String(freshness)
+}
+
+/**
+ * The linked pages with their labels resolved, so the exhaustive mapping above is applied once
+ * per row rather than on every re-render, and the template stays a list.
+ */
+const sourceRows = computed(() => {
+  const sources = outcome.value?.sources
+  if (!sources || sources.status !== 'reported') return []
+  return sources.sources.map((source) => ({
+    ...source,
+    icon: documents.descriptorForOrigin(source.origin)?.icon ?? 'i-lucide-file-text',
+    revision: revisionLabel(source.freshness),
+  }))
+})
+
 /** Drill into the full test report (this card is the summary, never a replacement for it). */
 function openTestReport() {
   if (instance.value) ui.openTestEvidence(instance.value.id)
@@ -358,6 +408,49 @@ function openTestReport() {
         </p>
       </section>
 
+      <!-- What the run built FROM, and which revision of it. Directly under the ask, because it
+           is the rest of the brief: the description is what a person wrote, this is what the
+           agents actually read, and every section below is a statement about work done against
+           it. A design that moved mid-run is the reading that changes all of them. -->
+      <section class="mb-5" data-testid="outcome-sources">
+        <h3 class="mb-1.5 text-[11px] font-semibold uppercase tracking-wide text-slate-500">
+          {{ t('outcome.sources.title') }}
+        </h3>
+        <div v-if="outcome.sources.status === 'reported'" class="space-y-1">
+          <div
+            v-for="source in sourceRows"
+            :key="`${source.origin}:${source.url || source.title}`"
+            class="rounded-md border border-slate-800 bg-slate-900/60 px-2 py-1.5"
+            data-testid="outcome-source"
+          >
+            <DocumentOriginLink
+              :url="source.url ?? ''"
+              class="flex items-center gap-1.5 text-xs text-slate-300"
+              hover-class="hover:text-white"
+            >
+              <UIcon :name="source.icon" class="h-3.5 w-3.5 shrink-0 text-indigo-400" />
+              <span class="truncate">{{ source.title }}</span>
+            </DocumentOriginLink>
+            <p class="mt-0.5 text-[11px] text-slate-500" data-testid="outcome-source-revision">
+              {{ source.revision }}
+            </p>
+            <!-- Stated separately from the revision above: the last revision alone says the run
+                 ENDED current, and says nothing about the step that finished before the page
+                 changed under it. -->
+            <p
+              v-if="source.movedDuringRun"
+              class="mt-0.5 text-[11px] text-amber-300"
+              data-testid="outcome-source-moved"
+            >
+              {{ t('outcome.sources.moved') }}
+            </p>
+          </div>
+        </div>
+        <p v-else class="text-[13px] italic leading-relaxed text-slate-500">
+          {{ t(SOURCES_GAP_KEYS[outcome.sources.gap]) }}
+        </p>
+      </section>
+
       <!-- Requirement coverage: which required behaviours were checked, and what was seen. -->
       <section class="mb-5" data-testid="outcome-requirements">
         <h3 class="mb-1.5 text-[11px] font-semibold uppercase tracking-wide text-slate-500">

package/app/components/panels/StepToolServers.logic.spec.ts

@@ -1,12 +1,18 @@
 import { describe, it, expect } from 'vitest'
 import {
+  KNOWN_OBSERVED_STATUSES,
   KNOWN_REASONS,
+  OBSERVED_STATUS_KEY,
   REASON_KEY,
   REMEDY_KEY,
+  observationFor,
+  observationIsFault,
+  observationText,
   reasonText,
   remedyText,
+  unattributedObservations,
 } from './StepToolServers.logic'
-import type { ToolServerUnavailableReason } from '~/types/toolServers'
+import type { ObservedToolServer, ToolServerUnavailableReason } from '~/types/toolServers'
 
 /**
  * A dropped tool server is the whole point of this surface: until it existed, a run that quietly
@@ -98,3 +104,104 @@ function render(reason: string): { key: string; params?: Record<string, unknown>
   })
   return seen
 }
+
+/**
+ * The OBSERVED half: what the agent's CLI said about the servers the platform wired. Its whole
+ * value is a set of distinctions, and each one collapses into "looks fine" if it is lost — so
+ * these pin the distinctions rather than the copy.
+ */
+describe('tool-server startup observations', () => {
+  it('gives every observed status but `ready` its own copy', () => {
+    // `ready` is deliberately absent: a started server's line depends on its tool count, which is
+    // three sentences rather than one key. Everything else is exhaustive against the schema, so a
+    // member added on the backend fails here instead of rendering blank.
+    expect([...Object.keys(OBSERVED_STATUS_KEY), 'ready'].sort()).toEqual(
+      [...KNOWN_OBSERVED_STATUSES].sort(),
+    )
+    const keys = Object.values(OBSERVED_STATUS_KEY)
+    expect(new Set(keys).size).toBe(keys.length)
+  })
+
+  it('says NOTHING when no observation was made', () => {
+    // The distinction the whole field rests on. A codex run, an image one version behind and an
+    // unmapped runner pool all report nothing, and any placeholder here would read as a verdict
+    // about a server that was very likely fine.
+    expect(observationFor(undefined, 'slack')).toBeNull()
+    expect(observationText(null, (key) => key)).toBeNull()
+    expect(observationIsFault(null)).toBe(false)
+  })
+
+  it('distinguishes “nobody looked” from “the CLI never loaded it”', () => {
+    // Both render as an absent server on the chip if they are conflated, and only the second is
+    // evidence of anything. The first must never raise a fault.
+    const notLoaded = observationFor([{ id: 'jira', status: 'ready' }], 'slack')
+    expect(notLoaded).toEqual({ kind: 'not_loaded' })
+    expect(observationText(notLoaded, (key) => key)).toBe(
+      'panels.stepDetail.toolServers.observed.notLoaded',
+    )
+    expect(observationIsFault(notLoaded)).toBe(true)
+  })
+
+  it('separates “started with no tools” from “started, tools uncounted”', () => {
+    // A server that connected and exposes nothing reaches the agent exactly like one that was
+    // never wired, and every other signal about it says healthy — so it gets its own sentence
+    // rather than a "0 tools" that reads as a rendering artefact.
+    const none = observationFor([{ id: 'slack', status: 'ready', toolCount: 0 }], 'slack')
+    const uncounted = observationFor([{ id: 'slack', status: 'ready' }], 'slack')
+    const some = observationFor([{ id: 'slack', status: 'ready', toolCount: 3 }], 'slack')
+    expect(observationText(none, (key) => key)).toBe(
+      'panels.stepDetail.toolServers.observed.readyNoTools',
+    )
+    expect(observationText(uncounted, (key) => key)).toBe(
+      'panels.stepDetail.toolServers.observed.ready',
+    )
+    expect(observationText(some, (key) => key)).toBe(
+      'panels.stepDetail.toolServers.observed.readyTools',
+    )
+    // None of the three is a fault: the count is a diagnosis for a person to read, not a verdict
+    // the surface should paint red.
+    for (const observation of [none, uncounted, some]) {
+      expect(observationIsFault(observation)).toBe(false)
+    }
+  })
+
+  it('flags the two states the platform promised a tool it did not get', () => {
+    for (const status of ['failed', 'needs_auth'] as const) {
+      expect(observationIsFault(observationFor([{ id: 'slack', status }], 'slack'))).toBe(true)
+    }
+  })
+
+  it('never flags a state the report did not resolve', () => {
+    // `unknown` is a fact about THIS build (a word it could not map) or about the moment the
+    // report was taken (a server still handshaking), never about the server itself. Painting it
+    // as a fault would send an operator to debug a working integration every time a CLI adds a
+    // status word or starts a server a moment slower than the session announcement.
+    // Cast, because the point is a value the TYPE excludes and the DATA carries: the vocabulary
+    // is persisted on a run, so a status recorded by a newer harness (or retired since) reads back
+    // here as a member this build has no case for.
+    const persisted = observationFor(
+      [{ id: 'slack', status: 'reticulating' } as unknown as ObservedToolServer],
+      'slack',
+    )
+    expect(persisted).toEqual({ kind: 'loaded', status: 'unknown' })
+    expect(observationIsFault(persisted)).toBe(false)
+  })
+
+  it('states a report naming servers the dispatch did not wire', () => {
+    // Empty on every ordinary run (`--strict-mcp-config`). The only way to reach it is a producer
+    // describing some OTHER job, and silently filtering those rows would present that report as
+    // this run's clean bill of health.
+    const record = {
+      agentKind: 'coder',
+      wired: [{ id: 'slack', label: 'Slack', transport: 'http' as const }],
+      unavailable: [],
+      observed: [
+        { id: 'slack', status: 'ready' as const },
+        { id: 'stranger', status: 'ready' as const },
+      ],
+    }
+    expect(unattributedObservations(record).map((s) => s.id)).toEqual(['stranger'])
+    // …and nothing to state when there was no report at all.
+    expect(unattributedObservations({ ...record, observed: undefined })).toEqual([])
+  })
+})

package/app/components/panels/StepToolServers.logic.ts

@@ -1,5 +1,13 @@
-import { toolServerUnavailableReasonSchema } from '@cat-factory/contracts'
-import type { ToolServerUnavailableReason } from '~/types/toolServers'
+import {
+  toolServerObservedStatusSchema,
+  toolServerUnavailableReasonSchema,
+} from '@cat-factory/contracts'
+import type {
+  ObservedToolServer,
+  StepToolServers,
+  ToolServerObservedStatus,
+  ToolServerUnavailableReason,
+} from '~/types/toolServers'
 
 // The step surface's tool-server (MCP) reason mapping. Kept out of the SFC on the same seam as
 // `StepTestReport.logic.ts`, so the vocabulary rule can be asserted without mounting a component.
@@ -102,3 +110,143 @@ export function remedyText(
 ): string | null {
   return isKnownReason(reason) ? t(REMEDY_KEY[reason]) : null
 }
+
+// ---------------------------------------------------------------------------
+// The OBSERVED half: what the agent's CLI reported about the servers it loaded.
+//
+// The mapping above answers "why did the platform withhold this tool". This one answers the
+// question that mapping structurally cannot: a server that passed every check, was promised to the
+// agent in its prompt, and then did not come up. The two are rendered together on one chip because
+// they are two halves of one answer about one server — but they are never merged into one status,
+// because a withheld server and a failed one need different people to fix different things.
+// ---------------------------------------------------------------------------
+
+/**
+ * What this build knows about one WIRED server after joining the CLI's report onto it.
+ *
+ * `null` and `not_loaded` are the pair this whole type exists to keep apart, and conflating them is
+ * the mistake that would make the surface lie. `null` means NO OBSERVATION WAS MADE — the run's
+ * harness publishes no report (codex's CLI does not, nor does any image older than the one that
+ * introduced this, nor an unmapped runner pool) — so nothing at all is known about whether the
+ * server started. `not_loaded` means an observation WAS made and this server was not in it, which
+ * is positive evidence that the CLI never loaded it. Rendering the first as the second would
+ * accuse every wired server on every deployment one image behind.
+ */
+export type ToolServerObservation =
+  | null
+  | { kind: 'loaded'; status: ToolServerObservedStatus; toolCount?: number }
+  | { kind: 'not_loaded' }
+
+/**
+ * Join the CLI's report onto one wired server id.
+ *
+ * Takes the whole `observed` field rather than a prepared map so the absent-vs-empty decision is
+ * made HERE, in the one place that owns the distinction, instead of by each caller building the
+ * map. An absent field yields `null` for every server; a present one yields either the CLI's line
+ * or `not_loaded`.
+ */
+export function observationFor(
+  observed: readonly ObservedToolServer[] | undefined,
+  id: string,
+): ToolServerObservation {
+  if (!observed) return null
+  const found = observed.find((server) => server.id === id)
+  if (!found) return { kind: 'not_loaded' }
+  return {
+    kind: 'loaded',
+    status: isKnownObservedStatus(found.status) ? found.status : 'unknown',
+    // Carried only when the CLI counted, and `0` is carried: a server that connected and exposed
+    // nothing reaches the agent exactly like one that was never wired, so it is the most
+    // diagnostic count on the field and the one a truthiness guard would erase.
+    ...(typeof found.toolCount === 'number' ? { toolCount: found.toolCount } : {}),
+  }
+}
+
+/**
+ * The servers the CLI named that this step's record does not list as wired.
+ *
+ * Empty by construction on every ordinary run: the harness starts the CLI under
+ * `--strict-mcp-config`, so the only servers it can load are the ones this dispatch wrote for it.
+ * Surfaced anyway rather than filtered out, because the one way to reach it is a producer whose
+ * report does not describe this job — a runner-pool manifest pointing `toolServersPath` at the
+ * wrong field, say — and a surface that silently dropped those rows would present a report about
+ * some other job as a clean bill of health for this one.
+ */
+export function unattributedObservations(record: StepToolServers): ObservedToolServer[] {
+  if (!record.observed) return []
+  const wired = new Set(record.wired.map((server) => server.id))
+  return record.observed.filter((server) => !wired.has(server.id))
+}
+
+/**
+ * The i18n key per observed status, for a server the CLI DID name. An exhaustive `Record` for the
+ * same reason {@link REASON_KEY} is one: a member added to the wire vocabulary must fail to
+ * compile here rather than render as a blank line.
+ *
+ * `ready` is deliberately absent — a started server's line depends on its tool COUNT, which is
+ * three separate sentences (counted some, counted none, did not count), so it is resolved by
+ * {@link observationText} rather than by a single key.
+ */
+export const OBSERVED_STATUS_KEY: Record<Exclude<ToolServerObservedStatus, 'ready'>, string> = {
+  failed: 'panels.stepDetail.toolServers.observed.failed',
+  needs_auth: 'panels.stepDetail.toolServers.observed.needsAuth',
+  unknown: 'panels.stepDetail.toolServers.observed.unknown',
+}
+
+/** The observed-status vocabulary as the SCHEMA states it: what a parity assertion grades against. */
+export const KNOWN_OBSERVED_STATUSES = toolServerObservedStatusSchema.options
+
+/**
+ * Whether a persisted status is a member THIS build knows, derived from the picklist's own options.
+ * A predicate rather than a truthiness check on the lookup, for the reason {@link isKnownReason}
+ * gives: an `Object.prototype` member name reads back as a truthy non-key.
+ */
+export function isKnownObservedStatus(status: string): status is ToolServerObservedStatus {
+  return (KNOWN_OBSERVED_STATUSES as readonly string[]).includes(status)
+}
+
+/**
+ * Render one observation, or `null` when there is nothing to say.
+ *
+ * `null` is returned for `null` — no observation was made — and it is the whole reason this
+ * function exists rather than a template expression: the surface must be BYTE-FOR-BYTE what it was
+ * before this field existed on every run that carries no report, which is every codex run, every
+ * run on an image one version behind, and every run on an unmapped runner pool. Silence is the
+ * only honest rendering of "nobody looked".
+ */
+export function observationText(
+  observation: ToolServerObservation,
+  t: (key: string, params?: Record<string, unknown>) => string,
+): string | null {
+  if (observation === null) return null
+  if (observation.kind === 'not_loaded') {
+    return t('panels.stepDetail.toolServers.observed.notLoaded')
+  }
+  if (observation.status !== 'ready') return t(OBSERVED_STATUS_KEY[observation.status])
+  if (observation.toolCount === undefined) {
+    return t('panels.stepDetail.toolServers.observed.ready')
+  }
+  // Zero gets its own sentence rather than "0 tools": a server that started and offers nothing is
+  // a distinct fault (a narrowed `allowedTools` matching nothing, a vendor that authenticated and
+  // served an empty catalog), and it is the one an operator would otherwise never suspect,
+  // because every other signal about it says healthy.
+  return observation.toolCount === 0
+    ? t('panels.stepDetail.toolServers.observed.readyNoTools')
+    : t('panels.stepDetail.toolServers.observed.readyTools', { count: observation.toolCount })
+}
+
+/**
+ * Whether an observation should DRAW ATTENTION on the chip: the server was promised to the agent
+ * and the CLI could not deliver it.
+ *
+ * `unknown` is deliberately NOT alarming. It covers a word this build could not map (a fact about
+ * this build rather than about the server) and a server the CLI reported as still handshaking when
+ * it announced the session (a fact about the moment the report was taken). Neither says anything
+ * happened to the server, and painting either as a fault would send an operator to debug a working
+ * integration every time a CLI adds a status or starts a server a moment slower.
+ */
+export function observationIsFault(observation: ToolServerObservation): boolean {
+  if (observation === null) return false
+  if (observation.kind === 'not_loaded') return true
+  return observation.status === 'failed' || observation.status === 'needs_auth'
+}

package/app/components/panels/StepToolServers.vue

@@ -8,6 +8,13 @@
 // unavailable server is a chip of its own with its own translated reason, never a shorter list of
 // the wired ones: "absent" and "zero" must not render the same.
 //
+// The wired half carries a SECOND answer when the run's harness reported one: what the agent's
+// CLI said about each server when it started up. The two are deliberately not merged into one
+// status — the platform withholding a tool and the CLI failing to start one are different faults
+// for different people — and the absence of a CLI report renders as nothing at all, because
+// "nobody looked" and "the CLI loaded nothing" are opposite facts and only silence states the
+// first one honestly (a codex run, an older image and an unmapped runner pool all reach it).
+//
 // SELF-HIDING when the record holds nothing, like the sibling panels around it. The record is
 // written on EVERY container dispatch, so both lists empty is the state of every step on every
 // deployment that registers no tool servers at all — the overwhelming default. That state is a
@@ -16,7 +23,14 @@
 // section on every step of every run to say nothing happened. The distinction absent-vs-empty is
 // still carried on the wire and answered by the debug API, which is where a reader asking it looks.
 import type { StepToolServers } from '~/types/toolServers'
-import { reasonText, remedyText } from '~/components/panels/StepToolServers.logic'
+import {
+  observationFor,
+  observationIsFault,
+  observationText,
+  reasonText,
+  remedyText,
+  unattributedObservations,
+} from '~/components/panels/StepToolServers.logic'
 import { agentKindMeta } from '~/utils/catalog'
 
 const props = defineProps<{
@@ -33,8 +47,22 @@ const props = defineProps<{
 
 const { t } = useI18n()
 
+/**
+ * Servers the CLI named that this dispatch did not wire. Empty on every ordinary run (the CLI runs
+ * under `--strict-mcp-config`), and surfaced rather than filtered because the only way to reach it
+ * is a report that describes some other job — which must not be presented as this job's clean bill
+ * of health.
+ */
+const unattributed = computed(() => unattributedObservations(props.toolServers))
+
 const hasAny = computed(
-  () => props.toolServers.wired.length > 0 || props.toolServers.unavailable.length > 0,
+  () =>
+    props.toolServers.wired.length > 0 ||
+    props.toolServers.unavailable.length > 0 ||
+    // A report about servers this dispatch did not wire is the one thing worth showing on an
+    // otherwise empty record: both lists empty says the dispatched kind declared none, and a CLI
+    // naming servers anyway contradicts exactly that.
+    unattributed.value.length > 0,
 )
 
 /** Set only when a helper re-dispatch owns this record, so the ordinary case renders no extra line. */
@@ -44,6 +72,22 @@ const dispatchedAs = computed(() =>
     : null,
 )
 
+/**
+ * Each wired server with the CLI's own verdict joined onto it, when a verdict was reported. Bound
+ * here for the same reason `drops` is: the join and the absent-vs-not-loaded decision are pure and
+ * assertable without mounting, and resolving them once per record beats once per re-render.
+ */
+const wired = computed(() =>
+  props.toolServers.wired.map((server) => {
+    const observation = observationFor(props.toolServers.observed, server.id)
+    return {
+      ...server,
+      observedText: observationText(observation, (key, params) => t(key, params ?? {})),
+      isFault: observationIsFault(observation),
+    }
+  }),
+)
+
 /**
  * Each dropped server with both halves of its answer resolved: WHY it was dropped, and what to
  * change so the next run gets it. Bound here rather than called from the template so the pure
@@ -80,20 +124,59 @@ const drops = computed(() =>
       {{ t('panels.stepDetail.toolServers.dispatchedAs', { agent: dispatchedAs }) }}
     </p>
 
-    <ul v-if="toolServers.wired.length" class="flex flex-wrap gap-1.5">
+    <ul v-if="wired.length" class="flex flex-wrap gap-1.5">
       <li
-        v-for="server in toolServers.wired"
+        v-for="server in wired"
         :key="server.id"
         data-testid="step-tool-server-wired"
-        class="inline-flex items-center gap-1.5 rounded-full border border-emerald-500/30 bg-emerald-500/10 px-2 py-0.5 text-[12px] text-emerald-200"
+        :data-observed-fault="server.isFault ? 'true' : undefined"
+        class="inline-flex items-center gap-1.5 rounded-full border px-2 py-0.5 text-[12px]"
+        :class="
+          server.isFault
+            ? 'border-amber-500/30 bg-amber-500/10 text-amber-200'
+            : 'border-emerald-500/30 bg-emerald-500/10 text-emerald-200'
+        "
         :title="
           server.tools?.length
             ? t('panels.stepDetail.toolServers.narrowed', { tools: server.tools.join(', ') })
             : t('panels.stepDetail.toolServers.allTools')
         "
       >
-        <UIcon name="i-lucide-check" class="h-3.5 w-3.5" />
+        <UIcon
+          :name="server.isFault ? 'i-lucide-triangle-alert' : 'i-lucide-check'"
+          class="h-3.5 w-3.5"
+        />
         <span>{{ server.label || server.id }}</span>
+        <!--
+          The CLI's own verdict, when the run's harness reported one. Absent renders NOTHING: a
+          harness that publishes no report has said nothing about this server, and a placeholder
+          would read as a verdict.
+        -->
+        <span
+          v-if="server.observedText"
+          data-testid="step-tool-server-observed"
+          class="opacity-80"
+          >{{ server.observedText }}</span
+        >
+      </li>
+    </ul>
+
+    <!--
+      A report naming servers this dispatch did not wire can only come from a producer describing
+      some other job (a runner-pool manifest mapped at the wrong field). Stated rather than
+      filtered, so the rest of the report is not read as authoritative about this run.
+    -->
+    <ul v-if="unattributed.length" class="mt-2 space-y-1.5">
+      <li
+        v-for="server in unattributed"
+        :key="server.id"
+        data-testid="step-tool-server-unattributed"
+        class="flex items-start gap-1.5 text-[12px] text-slate-400"
+      >
+        <UIcon name="i-lucide-circle-help" class="mt-0.5 h-3.5 w-3.5 shrink-0" />
+        <span>{{
+          t('panels.stepDetail.toolServers.observed.unattributed', { id: server.id })
+        }}</span>
       </li>
     </ul>
 

package/app/types/toolServers.ts

@@ -6,11 +6,13 @@
 // member added on one side only renders as a blank chip rather than failing to compile.
 
 export type {
+  ObservedToolServer,
   StepToolServers,
   ToolServerUnavailableReason,
   ToolServerAllowedToolsCheck,
   ToolServerCredential,
   ToolServerNotProbeableReason,
+  ToolServerObservedStatus,
   ToolServerOAuthGrant,
   ToolServerOAuthStatus,
   ToolServerProbeResult,

package/app/utils/runOutcome.ts

@@ -27,6 +27,8 @@ export type {
   OutcomePullRequest,
   OutcomeRequirement,
   OutcomeRequirements,
+  OutcomeSource,
+  OutcomeSources,
   OutcomeSpecJoin,
   OutcomeTests,
   OutcomeVisual,
@@ -34,6 +36,7 @@ export type {
   RequirementsGap,
   RunOutcome,
   RunUnavailableGap,
+  SourcesGap,
   TestsGap,
   TestsVerdict,
   VisualsGap,

package/i18n/locales/de.json

@@ -2001,6 +2001,16 @@
           "oauthNotConnected": "Verbinden Sie dieses Board im Infrastruktur-Fenster damit. Ein Deployment ohne ENCRYPTION_KEY hat keinen Ort für eine Berechtigung, das muss ein Betreiber also zuerst setzen.",
           "oauthTokenFailed": "Verbinden Sie es im Infrastruktur-Fenster neu, oder warten Sie die Störung des Anbieters ab.",
           "overBudget": "Kürzen Sie, was der Agent deklariert, damit ein Lauf alles mitführen kann."
+        },
+        "observed": {
+          "ready": "gestartet",
+          "readyTools": "{count} Tools",
+          "readyNoTools": "gestartet, keine Tools",
+          "failed": "Start fehlgeschlagen",
+          "needsAuth": "Autorisierung erforderlich",
+          "unknown": "Zustand ungeklärt",
+          "notLoaded": "nie geladen",
+          "unattributed": "Die Agenten-CLI meldete einen Server, den dieser Schritt nicht eingebunden hat: {id}."
         }
       },
       "adherence": {
@@ -6116,6 +6126,15 @@
       "title": "Was gefordert war",
       "none": "Diese Aufgabe hat keine Beschreibung, es gibt hier also nichts, womit sich das Ergebnis vergleichen ließe."
     },
+    "sources": {
+      "title": "Erstellt aus",
+      "unchecked": "Nicht mit der Quelle abgeglichen.",
+      "noSource": "Keine Quellseite zum Abgleichen vorhanden.",
+      "moved": "Diese Seite wurde während des Laufs geändert, frühere Schritte haben also eine ältere Revision gelesen.",
+      "gap": {
+        "none_linked": "Zu diesem Lauf gelangte keine Seite zu den Agenten, sie arbeiteten allein mit der Aufgabenbeschreibung."
+      }
+    },
     "gap": {
       "run_unavailable": "Der Lauf dieser Aufgabe wurde nicht geladen, deshalb können die von ihm erfassten Belege hier nicht gezeigt werden. Das ist nicht dasselbe wie ein Lauf, der nichts erfasst hat."
     },

package/i18n/locales/en.json

@@ -1535,6 +1535,16 @@
           "oauthNotConnected": "Connect this board to it from the Infrastructure window. A deployment with no ENCRYPTION_KEY has nowhere to keep a grant, so an operator has to set that first.",
           "oauthTokenFailed": "Reconnect it from the Infrastructure window, or wait out the vendor's outage.",
           "overBudget": "Trim what the agent declares, so one run can carry all of it."
+        },
+        "observed": {
+          "ready": "started",
+          "readyTools": "{count} tools",
+          "readyNoTools": "started, no tools",
+          "failed": "failed to start",
+          "needsAuth": "needs authorization",
+          "unknown": "state unresolved",
+          "notLoaded": "never loaded",
+          "unattributed": "The agent CLI reported a server this step did not wire: {id}."
         }
       },
       "adherence": {
@@ -5829,6 +5839,15 @@
       "title": "What was asked",
       "none": "This task carries no description, so there is nothing here to compare the result against."
     },
+    "sources": {
+      "title": "Built from",
+      "unchecked": "Not checked against the source.",
+      "noSource": "No source page to compare against.",
+      "moved": "This page changed while the run was in flight, so earlier steps read an older revision.",
+      "gap": {
+        "none_linked": "No page reached this run's agents, so they worked from the task description alone."
+      }
+    },
     "gap": {
       "run_unavailable": "This task's run was not loaded, so none of the evidence it recorded can be shown here. That is not the same as a run that recorded nothing."
     },

package/i18n/locales/es.json

@@ -1444,6 +1444,16 @@
           "oauthNotConnected": "Conecta este tablero con él desde la ventana de Infraestructura. Un despliegue sin ENCRYPTION_KEY no tiene dónde guardar una concesión, así que un operador debe configurarla primero.",
           "oauthTokenFailed": "Vuelve a conectarlo desde la ventana de Infraestructura, o espera a que pase la caída del proveedor.",
           "overBudget": "Recorta lo que declara el agente, para que una ejecución pueda llevarlo todo."
+        },
+        "observed": {
+          "ready": "iniciado",
+          "readyTools": "{count} herramientas",
+          "readyNoTools": "iniciado, sin herramientas",
+          "failed": "no arrancó",
+          "needsAuth": "requiere autorización",
+          "unknown": "estado sin determinar",
+          "notLoaded": "nunca se cargó",
+          "unattributed": "La CLI del agente informó de un servidor que este paso no conectó: {id}."
         }
       },
       "adherence": {
@@ -5560,6 +5570,15 @@
       "title": "Qué se pidió",
       "none": "Esta tarea no tiene descripción, así que no hay nada con lo que comparar el resultado."
     },
+    "sources": {
+      "title": "Creado a partir de",
+      "unchecked": "No se ha comprobado con la fuente.",
+      "noSource": "No hay página de origen con la que comparar.",
+      "moved": "Esta página cambió mientras la ejecución estaba en curso, así que los pasos anteriores leyeron una revisión más antigua.",
+      "gap": {
+        "none_linked": "Ninguna página llegó a los agentes de esta ejecución, así que trabajaron solo con la descripción de la tarea."
+      }
+    },
     "gap": {
       "run_unavailable": "La ejecución de esta tarea no se cargó, así que aquí no pueden mostrarse las pruebas que registró. No es lo mismo que una ejecución que no registró nada."
     },

package/i18n/locales/fr.json

@@ -1444,6 +1444,16 @@
           "oauthNotConnected": "Connectez ce tableau à ce serveur depuis la fenêtre Infrastructure. Un déploiement sans ENCRYPTION_KEY n’a nulle part où conserver une autorisation : un opérateur doit d’abord la définir.",
           "oauthTokenFailed": "Reconnectez-le depuis la fenêtre Infrastructure, ou attendez la fin de la panne du fournisseur.",
           "overBudget": "Réduisez ce que l’agent déclare, pour qu’une exécution puisse tout transporter."
+        },
+        "observed": {
+          "ready": "démarré",
+          "readyTools": "{count} outils",
+          "readyNoTools": "démarré, aucun outil",
+          "failed": "n'a pas démarré",
+          "needsAuth": "autorisation requise",
+          "unknown": "état non déterminé",
+          "notLoaded": "jamais chargé",
+          "unattributed": "La CLI d'agent a signalé un serveur que cette étape n'a pas branché : {id}."
         }
       },
       "adherence": {
@@ -5560,6 +5570,15 @@
       "title": "Ce qui était demandé",
       "none": "Cette tâche n'a pas de description, il n'y a donc rien à quoi comparer le résultat."
     },
+    "sources": {
+      "title": "Construit à partir de",
+      "unchecked": "Non vérifié auprès de la source.",
+      "noSource": "Aucune page source à laquelle comparer.",
+      "moved": "Cette page a changé pendant l'exécution : les étapes antérieures ont donc lu une révision plus ancienne.",
+      "gap": {
+        "none_linked": "Aucune page n'est parvenue aux agents de cette exécution, ils ont donc travaillé uniquement à partir de la description de la tâche."
+      }
+    },
     "gap": {
       "run_unavailable": "L'exécution de cette tâche n'a pas été chargée : les éléments qu'elle a enregistrés ne peuvent donc pas être affichés ici. Ce n'est pas la même chose qu'une exécution qui n'a rien enregistré."
     },

package/i18n/locales/he.json

@@ -1444,6 +1444,16 @@
           "oauthNotConnected": "חברו את הלוח הזה אליו מחלון התשתית. בפריסה ללא ENCRYPTION_KEY אין היכן לשמור הרשאה, ולכן מפעיל צריך להגדיר אותו קודם.",
           "oauthTokenFailed": "חברו אותו מחדש מחלון התשתית, או המתינו לסיום התקלה אצל הספק.",
           "overBudget": "צמצמו את מה שהסוכן מצהיר עליו, כדי שריצה אחת תוכל לשאת הכול."
+        },
+        "observed": {
+          "ready": "הופעל",
+          "readyTools": "{count} כלים",
+          "readyNoTools": "הופעל, ללא כלים",
+          "failed": "לא עלה",
+          "needsAuth": "דורש הרשאה",
+          "unknown": "מצב לא ידוע",
+          "notLoaded": "מעולם לא נטען",
+          "unattributed": "ממשק הסוכן דיווח על שרת שהשלב הזה לא חיבר: {id}."
         }
       },
       "adherence": {
@@ -5560,6 +5570,15 @@
       "title": "מה התבקש",
       "none": "למשימה הזאת אין תיאור, ולכן אין מול מה להשוות את התוצאה."
     },
+    "sources": {
+      "title": "נבנה מתוך",
+      "unchecked": "לא נבדק מול המקור.",
+      "noSource": "אין עמוד מקור להשוואה.",
+      "moved": "העמוד הזה השתנה בזמן שההרצה רצה, ולכן שלבים מוקדמים קראו גרסה ישנה יותר.",
+      "gap": {
+        "none_linked": "לא הגיע אף עמוד לסוכנים של הרצה זו, ולכן הם עבדו לפי תיאור המשימה בלבד."
+      }
+    },
     "gap": {
       "run_unavailable": "ההרצה של המשימה הזאת לא נטענה, ולכן הראיות שהיא תיעדה לא מוצגות כאן. זה לא אותו דבר כמו הרצה שלא תיעדה כלום."
     },

package/i18n/locales/it.json

@@ -2001,6 +2001,16 @@
           "oauthNotConnected": "Collega questa lavagna al server dalla finestra Infrastruttura. Un deployment senza ENCRYPTION_KEY non ha dove conservare una concessione, quindi un operatore deve impostarla prima.",
           "oauthTokenFailed": "Ricollegalo dalla finestra Infrastruttura, oppure attendi la fine del disservizio del fornitore.",
           "overBudget": "Riduci ciò che l'agente dichiara, così una singola esecuzione può portarlo tutto."
+        },
+        "observed": {
+          "ready": "avviato",
+          "readyTools": "{count} strumenti",
+          "readyNoTools": "avviato, nessuno strumento",
+          "failed": "non si è avviato",
+          "needsAuth": "richiede autorizzazione",
+          "unknown": "stato non determinato",
+          "notLoaded": "mai caricato",
+          "unattributed": "La CLI dell'agente ha segnalato un server che questo passo non ha collegato: {id}."
         }
       },
       "adherence": {
@@ -6116,6 +6126,15 @@
       "title": "Che cosa era stato chiesto",
       "none": "Questa attività non ha una descrizione, quindi non c'è nulla con cui confrontare l'esito."
     },
+    "sources": {
+      "title": "Costruito a partire da",
+      "unchecked": "Non verificato con la sorgente.",
+      "noSource": "Nessuna pagina di origine con cui confrontare.",
+      "moved": "Questa pagina è cambiata mentre l'esecuzione era in corso, quindi i passi precedenti hanno letto una revisione più vecchia.",
+      "gap": {
+        "none_linked": "Nessuna pagina è arrivata agli agenti di questa esecuzione, che hanno lavorato solo sulla descrizione dell'attività."
+      }
+    },
     "gap": {
       "run_unavailable": "L'esecuzione di questa attività non è stata caricata, quindi le prove che ha registrato non possono essere mostrate qui. Non è la stessa cosa di un'esecuzione che non ha registrato nulla."
     },

package/i18n/locales/ja.json

@@ -1444,6 +1444,16 @@
           "oauthNotConnected": "インフラストラクチャ ウィンドウからこのボードを接続してください。ENCRYPTION_KEY のないデプロイには許可を保管する場所がないため、まず運用者がそれを設定する必要があります。",
           "oauthTokenFailed": "インフラストラクチャ ウィンドウから接続し直すか、提供元の障害が収まるのを待ってください。",
           "overBudget": "1 回の実行ですべて運べるよう、このエージェントの宣言を減らしてください。"
+        },
+        "observed": {
+          "ready": "起動済み",
+          "readyTools": "ツール {count} 個",
+          "readyNoTools": "起動済み、ツールなし",
+          "failed": "起動に失敗",
+          "needsAuth": "認可が必要",
+          "unknown": "状態は未確定",
+          "notLoaded": "読み込まれませんでした",
+          "unattributed": "エージェント CLI が、このステップでは接続していないサーバーを報告しました: {id}。"
         }
       },
       "adherence": {
@@ -5560,6 +5570,15 @@
       "title": "依頼内容",
       "none": "このタスクには説明がないため、結果と照らし合わせるものがありません。"
     },
+    "sources": {
+      "title": "参照した資料",
+      "unchecked": "ソースとの照合は行われていません。",
+      "noSource": "比較できるソースページがありません。",
+      "moved": "このページは実行中に変更されたため、前半のステップは古いリビジョンを読んでいます。",
+      "gap": {
+        "none_linked": "この実行のエージェントにはページが渡されなかったため、タスクの説明だけを頼りに作業しました。"
+      }
+    },
     "gap": {
       "run_unavailable": "このタスクの実行が読み込まれていないため、そこに記録された根拠をここには表示できません。何も記録しなかった実行とは別のことです。"
     },

package/i18n/locales/pl.json

@@ -1444,6 +1444,16 @@
           "oauthNotConnected": "Połącz tę tablicę z serwerem w oknie Infrastruktura. Wdrożenie bez ENCRYPTION_KEY nie ma gdzie przechować zgody, więc operator musi ją najpierw ustawić.",
           "oauthTokenFailed": "Połącz go ponownie w oknie Infrastruktura albo przeczekaj awarię dostawcy.",
           "overBudget": "Skróć to, co deklaruje agent, aby jedno uruchomienie uniosło całość."
+        },
+        "observed": {
+          "ready": "uruchomiony",
+          "readyTools": "narzędzia: {count}",
+          "readyNoTools": "uruchomiony, bez narzędzi",
+          "failed": "nie wystartował",
+          "needsAuth": "wymaga autoryzacji",
+          "unknown": "stan nieustalony",
+          "notLoaded": "nigdy nie wczytany",
+          "unattributed": "CLI agenta zgłosiło serwer, którego ten krok nie podłączył: {id}."
         }
       },
       "adherence": {
@@ -5560,6 +5570,15 @@
       "title": "O co proszono",
       "none": "To zadanie nie ma opisu, więc nie ma do czego porównać wyniku."
     },
+    "sources": {
+      "title": "Zbudowano na podstawie",
+      "unchecked": "Nie sprawdzono ze źródłem.",
+      "noSource": "Brak strony źródłowej do porównania.",
+      "moved": "Ta strona zmieniła się w trakcie uruchomienia, więc wcześniejsze kroki czytały starszą wersję.",
+      "gap": {
+        "none_linked": "Do agentów tego przebiegu nie trafiła żadna strona, więc pracowali wyłącznie na opisie zadania."
+      }
+    },
     "gap": {
       "run_unavailable": "Przebieg tego zadania nie został wczytany, więc zapisane w nim dowody nie są tutaj pokazane. To co innego niż przebieg, który niczego nie zapisał."
     },

package/i18n/locales/tr.json

@@ -1444,6 +1444,16 @@
           "oauthNotConnected": "Bu panoyu Altyapı penceresinden ona bağlayın. ENCRYPTION_KEY olmayan bir dağıtımda izni saklayacak bir yer yoktur, bu yüzden önce bir operatörün bunu ayarlaması gerekir.",
           "oauthTokenFailed": "Altyapı penceresinden yeniden bağlayın ya da sağlayıcının kesintisinin geçmesini bekleyin.",
           "overBudget": "Tek bir çalıştırma hepsini taşıyabilsin diye ajanın bildirdiklerini kısaltın."
+        },
+        "observed": {
+          "ready": "başlatıldı",
+          "readyTools": "{count} araç",
+          "readyNoTools": "başlatıldı, araç yok",
+          "failed": "başlatılamadı",
+          "needsAuth": "yetkilendirme gerekiyor",
+          "unknown": "durum belirsiz",
+          "notLoaded": "hiç yüklenmedi",
+          "unattributed": "Ajan CLI'si bu adımın bağlamadığı bir sunucu bildirdi: {id}."
         }
       },
       "adherence": {
@@ -5560,6 +5570,15 @@
       "title": "Ne istenmişti",
       "none": "Bu görevin açıklaması yok, dolayısıyla sonucu karşılaştıracak bir şey de yok."
     },
+    "sources": {
+      "title": "Şuradan üretildi",
+      "unchecked": "Kaynakla karşılaştırılmadı.",
+      "noSource": "Karşılaştırılacak bir kaynak sayfa yok.",
+      "moved": "Bu sayfa çalışma sürerken değişti, bu yüzden önceki adımlar daha eski bir sürümü okudu.",
+      "gap": {
+        "none_linked": "Bu çalıştırmanın ajanlarına hiçbir sayfa ulaşmadı, bu yüzden yalnızca görev açıklamasıyla çalıştılar."
+      }
+    },
     "gap": {
       "run_unavailable": "Bu görevin çalışması yüklenmediği için kaydettiği kanıtlar burada gösterilemiyor. Bu, hiçbir şey kaydetmemiş bir çalışmayla aynı şey değildir."
     },

package/i18n/locales/uk.json

@@ -1444,6 +1444,16 @@
           "oauthNotConnected": "Під’єднайте цю дошку до нього у вікні інфраструктури. Розгортання без ENCRYPTION_KEY не має де зберігати дозвіл, тож оператор має спершу задати його.",
           "oauthTokenFailed": "Під’єднайте його заново у вікні інфраструктури або перечекайте збій постачальника.",
           "overBudget": "Скоротіть те, що оголошує агент, щоб один запуск ніс усе."
+        },
+        "observed": {
+          "ready": "запущено",
+          "readyTools": "інструментів: {count}",
+          "readyNoTools": "запущено, без інструментів",
+          "failed": "не запустився",
+          "needsAuth": "потрібна авторизація",
+          "unknown": "стан невизначений",
+          "notLoaded": "жодного разу не завантажено",
+          "unattributed": "CLI агента повідомив про сервер, який цей крок не під’єднував: {id}."
         }
       },
       "adherence": {
@@ -5560,6 +5570,15 @@
       "title": "Про що просили",
       "none": "У цього завдання немає опису, тож немає з чим порівняти результат."
     },
+    "sources": {
+      "title": "Створено на основі",
+      "unchecked": "Не звірено з джерелом.",
+      "noSource": "Немає сторінки джерела для звіряння.",
+      "moved": "Ця сторінка змінилася під час виконання, тож попередні кроки читали давнішу редакцію.",
+      "gap": {
+        "none_linked": "До агентів цього запуску не потрапила жодна сторінка, тож вони працювали лише з опису завдання."
+      }
+    },
     "gap": {
       "run_unavailable": "Запуск цього завдання не завантажено, тому зібрані ним докази тут не показані. Це не те саме, що запуск, який нічого не зібрав."
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.243.0",
+  "version": "0.245.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -40,7 +40,7 @@
     "valibot": "^1.4.2",
     "vue": "3.5.40",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.265.0"
+    "@cat-factory/contracts": "0.267.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",