agent-nuvira 3.3.11 → 3.3.13

package/dist/web-dashboard/server.js

@@ -25,11 +25,13 @@ import { loadEnv } from '../utils/env.js';
 import { ConfigManager } from '../config/manager.js';
 import { runAllChecks } from '../cli/doctor.js';
 import { getAutoRouter } from '../learning/auto-router.js';
+import { withStrictModel } from '../inference/route-resolver.js';
 import { readRecallHits } from '../context/session-recall.js';
 import { getRouterPromotion } from '../learning/router-promotion.js';
 import { AUTH_CLEAR_THRESHOLD } from '../learning/key-hygiene.js';
 import { ACTION_LOG_FILENAME, DEFAULT_STALE_MS, aggregateActionTelemetry, readActionTelemetryFile, getModelRegistry, } from '../learning/model-registry.js';
 import { classifyModelEntitlement } from '../inference/model-entitlement.js';
+import { capabilityBand, estimateModelCapability } from '../learning/model-capability.js';
 import { listUnattendedJobs } from '../learning/unattended-job.js';
 import { AdminSessions, countAdminRoleUsers, isAdminConfigured, listAdminUsers, mustChangePasswordFor, removeAdminUser, roleForUser, verifyAdmin, writeAdminUser, MIN_ADMIN_PASSWORD_LENGTH, } from './src/admin-auth.js';
 import { TaskRunner } from './task-runner.js';
@@ -2641,6 +2643,7 @@ function summarizeProvider(type, configManager) {
             : maskKey(key),
         model: c?.model,
         baseUrl: c?.baseUrl,
+        enabled: c?.enabled !== false,
     };
 }
 /**
@@ -2867,6 +2870,26 @@ export function setGatewayShutdownForTest(action) {
 function runDashboardShutdown() {
     dashboardShutdownAction();
 }
+/**
+ * The OmniRoute lifecycle actions behind /api/admin/omniroute. `null` (default)
+ * → the REAL probe/spawn/stop. Swappable for the same reason as the gateway-stop
+ * action: the real probe hits the network and the real start/stop spawns or
+ * signals a machine-wide process, so a ROUTE test must not do either.
+ */
+let omniRouteActions = null;
+/** Test hook: stub the OmniRoute lifecycle actions (null restores the real ones). */
+export function setOmniRouteActionsForTest(actions) {
+    omniRouteActions = actions;
+}
+/** The real actions, lazily imported so dashboard boot does not pull the CLI in. */
+async function realOmniRouteActions() {
+    const mod = await import('../cli/omniroute-control.js');
+    return {
+        status: () => mod.omnirouteStatus(),
+        start: () => mod.startOmniRoute(),
+        stop: () => mod.stopOmniRoute(),
+    };
+}
 /**
  * Test hook: swap the pairing manager (e.g. for a fake-bridge manager) so
  * /api/whatsapp integration tests never open a real WhatsApp connection.
@@ -3039,6 +3062,102 @@ function handleRequest(req, res) {
         res.end(JSON.stringify(readHistoryData()));
         return;
     }
+    // POST /api/history/clear — delete stored conversations. Body:
+    //   { target: 'session', id }        — delete ONE session (the History tab
+    //     used to be read-only: only clear-all or an age band existed)
+    //   { target: 'older', olderThanMs } — time-based bulk sweep
+    //   { target: 'all' }                — clear everything
+    // Same gate as the continuity store: this is local memory, so an authenticated
+    // admin/operator may change it. Reads (/api/history) stay open as before.
+    if (pathname === '/api/history/clear' && req.method === 'POST') {
+        const session = adminSessions.validate(bearerToken(req));
+        if (!session) {
+            writeJson(res, 401, { ok: false, error: 'Not authenticated — log in first.' });
+            return;
+        }
+        if (!roleCan(session.role, 'routing.operate')) {
+            writeJson(res, 403, { ok: false, error: `Access denied — role '${session.role}' cannot change conversation history.` });
+            return;
+        }
+        void (async () => {
+            const body = await readJsonBody(req);
+            const target = typeof body?.target === 'string' ? body.target : '';
+            const id = typeof body?.id === 'string' ? body.id : undefined;
+            const olderThanMs = typeof body?.olderThanMs === 'number' && body.olderThanMs > 0 ? body.olderThanMs : 0;
+            const { getChatHistory } = await import('../context/history.js');
+            const history = getChatHistory();
+            let removed = 0;
+            if (target === 'session' && id) {
+                if (await history.deleteSession(id))
+                    removed = 1;
+            }
+            else if (target === 'older' && olderThanMs > 0) {
+                removed = history.pruneOlderThan(olderThanMs);
+            }
+            else if (target === 'all') {
+                removed = history.count();
+                history.clear();
+            }
+            else {
+                writeJson(res, 400, { ok: false, error: "Expected { target: 'session', id } | { target: 'older', olderThanMs } | { target: 'all' }." });
+                return;
+            }
+            writeJson(res, 200, { ok: true, removed });
+        })();
+        return;
+    }
+    // ── Hook contract (declarative lifecycle rules) ──────────────────────────
+    // GET /api/hooks — the declared hooks plus the contract vocabulary the page
+    //   needs to render an editor (events, action kinds and their descriptions).
+    //   Reads are open like /api/history.
+    // PUT /api/hooks — replace the whole set. Gated on routing.operate (admin or
+    //   operator), the same capability every other config write uses. The server
+    //   VALIDATES before persisting, so a bad declaration is a 400 and the
+    //   previously-saved set stays in force.
+    if (pathname === '/api/hooks' && req.method === 'GET') {
+        void (async () => {
+            const m = await import('../gateway/hook-contract.js');
+            writeJson(res, 200, {
+                ok: true,
+                file: m.hookDeclarationsFile(),
+                hooks: m.getHookDeclarations(),
+                events: m.HOOK_EVENTS,
+                eventDescriptions: m.HOOK_EVENT_DESCRIPTIONS,
+                actionKinds: m.HOOK_ACTION_KINDS,
+                actionDescriptions: m.HOOK_ACTION_DESCRIPTIONS,
+            });
+        })();
+        return;
+    }
+    if (pathname === '/api/hooks' && req.method === 'PUT') {
+        void (async () => {
+            const session = adminSessions.validate(bearerToken(req));
+            if (!session) {
+                writeJson(res, 401, { ok: false, error: 'Not authenticated — log in first.' });
+                return;
+            }
+            if (!roleCan(session.role, 'routing.operate')) {
+                writeJson(res, 403, {
+                    ok: false,
+                    error: `Access denied — role '${session.role}' cannot change hooks (requires admin or operator).`,
+                });
+                return;
+            }
+            const body = await readJsonBody(req);
+            if (!body || !Array.isArray(body.hooks)) {
+                writeJson(res, 400, { ok: false, error: 'Invalid JSON body — expected { hooks: [...] }.' });
+                return;
+            }
+            const m = await import('../gateway/hook-contract.js');
+            const saved = m.setHookDeclarations(body.hooks);
+            if (!saved.ok) {
+                writeJson(res, 400, { ok: false, error: saved.error });
+                return;
+            }
+            writeJson(res, 200, { ok: true, hooks: saved.declarations });
+        })();
+        return;
+    }
     if (pathname === '/api/benchmarks') {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify(readBenchmarkData()));
@@ -3211,6 +3330,10 @@ function handleRequest(req, res) {
                 icon: entry?.icon,
                 envVar: entry?.envVar || null,
                 keyless: entry?.keyless === true,
+                // What it is / how to set it up — the dashboard renders these beside
+                // the key fields. Optional: most providers need no explanation.
+                ...(entry?.description ? { description: entry.description } : {}),
+                ...(entry?.setup ? { setup: entry.setup } : {}),
             };
         });
         writeJson(res, 200, { providers });
@@ -3324,6 +3447,67 @@ function handleRequest(req, res) {
         })();
         return;
     }
+    // ── OmniRoute gateway lifecycle (the EXTERNAL AI gateway on port 20128) ──
+    // OmniRoute is a separate long-lived process nuvira does not embed; the Admin
+    // page could configure it as a provider but not start/stop it or say whether
+    // it was up. GET reports reachability (a real HTTP probe — a 401 counts as UP),
+    // POST { action: 'start' | 'stop' } drives it. Reads need a session; start/stop
+    // need gateway.manage (the same gate as `nuvira omniroute start|stop` and
+    // `nuvira gateway stop`).
+    if (pathname === '/api/admin/omniroute' && (req.method === 'GET' || req.method === 'POST')) {
+        void (async () => {
+            const session = adminSessions.validate(bearerToken(req));
+            if (!session) {
+                writeJson(res, 401, { ok: false, error: 'Not authenticated — log in first.' });
+                return;
+            }
+            const actions = omniRouteActions ?? (await realOmniRouteActions());
+            try {
+                if (req.method === 'GET') {
+                    const status = await actions.status();
+                    writeJson(res, 200, { ok: true, status });
+                    return;
+                }
+                if (!roleCan(session.role, 'gateway.manage')) {
+                    writeJson(res, 403, {
+                        ok: false,
+                        error: `Access denied — role '${session.role}' cannot start or stop the OmniRoute gateway (requires admin or operator).`,
+                    });
+                    return;
+                }
+                const body = await readJsonBody(req);
+                const action = body?.action;
+                if (action === 'start') {
+                    const result = await actions.start();
+                    writeJson(res, 200, {
+                        ok: result.ok,
+                        action,
+                        started: result.started,
+                        detail: result.detail,
+                        status: result.status,
+                    });
+                    return;
+                }
+                if (action === 'stop') {
+                    const result = await actions.stop();
+                    writeJson(res, 200, {
+                        ok: result.stopped,
+                        action,
+                        stopped: result.stopped,
+                        reason: result.reason,
+                        pid: result.pid,
+                        status: await actions.status(),
+                    });
+                    return;
+                }
+                writeJson(res, 400, { ok: false, error: 'Invalid action — expected "start" or "stop".' });
+            }
+            catch (err) {
+                writeJson(res, 500, { ok: false, error: err instanceof Error ? err.message : String(err) });
+            }
+        })();
+        return;
+    }
     // ── Agent Hub toggles (I5) — admin-gated writes honored by the I1 runtime
     // gate (tool-loop schema + execution gating), so the dashboard toggle is
     // NEVER cosmetic. Same config the CLI writes (`nuvira tools toolsets`);
@@ -3622,6 +3806,121 @@ function handleRequest(req, res) {
         })();
         return;
     }
+    // ── Knowledge base (tag-scoped retrieval over the operator's own documents) ──
+    // Thin endpoints over learning/knowledge-base.ts: list tags, ingest a file or
+    // folder under a tag, query a tag, and forget a tag. Documents are extracted,
+    // chunked and embedded ONCE on ingest, so a query only embeds the question.
+    // Reads list a tag's metadata; writes (ingest/forget) need routing.operate.
+    if (pathname === '/api/knowledge' && req.method === 'GET') {
+        void (async () => {
+            const session = adminSessions.validate(bearerToken(req));
+            if (!session) {
+                writeJson(res, 401, { ok: false, error: 'Not authenticated — log in first.' });
+                return;
+            }
+            try {
+                const { listKnowledgeTags } = await import('../learning/knowledge-base.js');
+                writeJson(res, 200, { ok: true, tags: listKnowledgeTags() });
+            }
+            catch (err) {
+                writeJson(res, 500, { ok: false, error: err instanceof Error ? err.message : String(err) });
+            }
+        })();
+        return;
+    }
+    if (pathname === '/api/knowledge/ingest' && req.method === 'POST') {
+        void (async () => {
+            const session = adminSessions.validate(bearerToken(req));
+            if (!session) {
+                writeJson(res, 401, { ok: false, error: 'Not authenticated — log in first.' });
+                return;
+            }
+            if (!roleCan(session.role, 'routing.operate')) {
+                writeJson(res, 403, {
+                    ok: false,
+                    error: `Access denied — role '${session.role}' cannot ingest documents (requires admin or operator).`,
+                });
+                return;
+            }
+            const body = await readJsonBody(req);
+            const tag = typeof body?.tag === 'string' ? body.tag.trim() : '';
+            const paths = Array.isArray(body?.paths) ? body.paths.filter((p) => typeof p === 'string' && p.trim().length > 0) : [];
+            if (!tag) {
+                writeJson(res, 400, { ok: false, error: 'A tag is required.' });
+                return;
+            }
+            if (paths.length === 0) {
+                writeJson(res, 400, { ok: false, error: 'At least one file or folder path is required.' });
+                return;
+            }
+            try {
+                const { ingestKnowledge } = await import('../learning/knowledge-base.js');
+                const result = await ingestKnowledge(tag, paths);
+                writeJson(res, 200, { ok: true, ...result });
+            }
+            catch (err) {
+                writeJson(res, 400, { ok: false, error: err instanceof Error ? err.message : String(err) });
+            }
+        })();
+        return;
+    }
+    if (pathname === '/api/knowledge/query' && req.method === 'POST') {
+        void (async () => {
+            const session = adminSessions.validate(bearerToken(req));
+            if (!session) {
+                writeJson(res, 401, { ok: false, error: 'Not authenticated — log in first.' });
+                return;
+            }
+            const body = await readJsonBody(req);
+            const tag = typeof body?.tag === 'string' ? body.tag.trim() : '';
+            const question = typeof body?.question === 'string' ? body.question.trim() : '';
+            const topK = typeof body?.topK === 'number' ? body.topK : undefined;
+            if (!tag || !question) {
+                writeJson(res, 400, { ok: false, error: 'A tag and a question are required.' });
+                return;
+            }
+            try {
+                const { queryKnowledge } = await import('../learning/knowledge-base.js');
+                const hits = await queryKnowledge(tag, question, { topK });
+                writeJson(res, 200, { ok: true, tag, hits });
+            }
+            catch (err) {
+                writeJson(res, 500, { ok: false, error: err instanceof Error ? err.message : String(err) });
+            }
+        })();
+        return;
+    }
+    if (pathname === '/api/knowledge/forget' && req.method === 'POST') {
+        void (async () => {
+            const session = adminSessions.validate(bearerToken(req));
+            if (!session) {
+                writeJson(res, 401, { ok: false, error: 'Not authenticated — log in first.' });
+                return;
+            }
+            if (!roleCan(session.role, 'routing.operate')) {
+                writeJson(res, 403, {
+                    ok: false,
+                    error: `Access denied — role '${session.role}' cannot remove knowledge tags (requires admin or operator).`,
+                });
+                return;
+            }
+            const body = await readJsonBody(req);
+            const tag = typeof body?.tag === 'string' ? body.tag.trim() : '';
+            if (!tag) {
+                writeJson(res, 400, { ok: false, error: 'A tag is required.' });
+                return;
+            }
+            try {
+                const { forgetKnowledgeTag } = await import('../learning/knowledge-base.js');
+                const removed = await forgetKnowledgeTag(tag);
+                writeJson(res, 200, { ok: true, removed });
+            }
+            catch (err) {
+                writeJson(res, 500, { ok: false, error: err instanceof Error ? err.message : String(err) });
+            }
+        })();
+        return;
+    }
     // ── PA4 — save skill env vars to ~/.nuvira/.env (dashboard secret capture) ──
     if (pathname === '/api/skills/secrets' && req.method === 'POST') {
         void (async () => {
@@ -4568,6 +4867,26 @@ function handleRequest(req, res) {
                 }
                 if (typeof body.runner === 'string' && body.runner.trim().length > 0)
                     updates.runner = body.runner.trim();
+                // The On/Off switch. `false` removes the provider from the auto-routing
+                // pool WITHOUT deleting its credentials; `true` re-admits it.
+                if (typeof body.enabled === 'boolean')
+                    updates.enabled = body.enabled;
+                // A3 — a model id is validated against the provider's LIVE list before
+                // it is written, so a typo cannot become a silent substitution at run
+                // time. An unreachable provider is saved unverified (never blocked); a
+                // reachable one that does not serve the id is refused with suggestions.
+                if (typeof updates.model === 'string' && updates.model) {
+                    const { validateModelIdForProvider } = await import('../inference/model-id-validation.js');
+                    const verdict = await validateModelIdForProvider(type, updates.model, configManager);
+                    if (!verdict.ok) {
+                        writeJson(res, 400, {
+                            ok: false,
+                            error: verdict.message,
+                            suggestions: verdict.suggestions ?? [],
+                        });
+                        return;
+                    }
+                }
                 // Raw config (vault refs INTACT) — never save a resolved key back to
                 // plaintext (the documented resolveVaultRefs footgun).
                 const raw = configManager.getAll().providers[type] || {};
@@ -4583,7 +4902,7 @@ function handleRequest(req, res) {
             // explicit undefineds, so the fields vanish from the file.
             if (req.method === 'DELETE') {
                 const cleared = configManager.clearProviderApiKey(type);
-                configManager.save({ providers: { [type]: { apiKey: undefined, baseUrl: undefined, model: undefined, runner: undefined } } });
+                configManager.save({ providers: { [type]: { apiKey: undefined, baseUrl: undefined, model: undefined, runner: undefined, enabled: undefined } } });
                 clearModelListCache();
                 // An ENV-sourced key cannot be removed from the file (env re-injects on
                 // every load) — surface that so the UI warns instead of hiding the row.
@@ -6276,6 +6595,11 @@ function handleRequest(req, res) {
     // POST /api/continuity/clear — forget stored continuity data. Body:
     //   { target: 'sessions' | 'recall' }      — clear all of one kind
     //   { target: 'session' | 'recall-entry', id } — clear one entry
+    //   { target: 'sessions' | 'recall', olderThanMs } — TIME-BASED bulk: clear
+    //     only entries older than now − olderThanMs. Per-entry forgetting is fine
+    //     for a handful of records but tedious for a store that grows on every
+    //     run, so "forget anything older than a week" is one request instead of
+    //     N. Absent/<=0 → the existing clear-all behaviour, unchanged.
     if (pathname === '/api/continuity/clear' && req.method === 'POST') {
         const session = adminSessions.validate(bearerToken(req));
         if (!session) {
@@ -6290,8 +6614,23 @@ function handleRequest(req, res) {
             const body = await readJsonBody(req);
             const target = typeof body?.target === 'string' ? body.target : '';
             const id = typeof body?.id === 'string' ? body.id : undefined;
+            const olderThanMs = typeof body?.olderThanMs === 'number' && body.olderThanMs > 0 ? body.olderThanMs : 0;
+            const cutoff = olderThanMs > 0 ? Date.now() - olderThanMs : 0;
             let removed = 0;
-            if (target === 'sessions') {
+            if (target === 'sessions' && cutoff > 0) {
+                // Time-based bulk: only snapshots saved before the cutoff.
+                const { listSessionSnapshots, clearSession } = await import('../learning/session-store.js');
+                for (const s of listSessionSnapshots())
+                    if (s.savedAt < cutoff && clearSession(s.id))
+                        removed += 1;
+            }
+            else if (target === 'recall' && cutoff > 0) {
+                const { listRecallEntries, removeRecallEntry } = await import('../learning/session-recall.js');
+                for (const e of listRecallEntries())
+                    if (e.savedAt < cutoff && removeRecallEntry(e.id))
+                        removed += 1;
+            }
+            else if (target === 'sessions') {
                 const { listSessionSnapshots, clearSession } = await import('../learning/session-store.js');
                 for (const s of listSessionSnapshots())
                     if (clearSession(s.id))
@@ -6313,7 +6652,7 @@ function handleRequest(req, res) {
                     removed = 1;
             }
             else {
-                writeJson(res, 400, { ok: false, error: "Expected { target: 'sessions'|'recall'|'session'|'recall-entry', id? }." });
+                writeJson(res, 400, { ok: false, error: "Expected { target: 'sessions'|'recall'|'session'|'recall-entry', id?, olderThanMs? }." });
                 return;
             }
             writeJson(res, 200, { ok: true, removed });
@@ -6346,6 +6685,39 @@ function handleRequest(req, res) {
         })();
         return;
     }
+    // GET /api/chat/routable-models — the short list a chat model PICKER may
+    // offer: only pairs the router would actually use right now (the registry's
+    // own `isUsable` predicate), each with a capability estimate and band.
+    //
+    // WHY THIS EXISTS (2026-10-04). The user's question was fair: the chat had no
+    // way to choose a model, so every turn was Auto — and when Auto's floor had to
+    // relax it silently landed on a 4-bit LOCAL model. Offering a handful of
+    // ROUTABLE pairs (provider + model + capability) lets the user rule on Auto
+    // without ever being shown the 500-id catalog. Cheap: a registry read, no
+    // provider probe.
+    if (pathname === '/api/chat/routable-models' && req.method === 'GET') {
+        void (async () => {
+            const session = adminSessions.validate(bearerToken(req));
+            if (!session) {
+                writeJson(res, 401, { ok: false, error: 'Not authenticated — log in first.' });
+                return;
+            }
+            const registry = getModelRegistry();
+            const now = Date.now();
+            const models = [];
+            for (const provider of registry.getTrackedProviders()) {
+                for (const entry of registry.getAllModelsForProvider(provider)) {
+                    if (!registry.isUsable(provider, entry.model, now))
+                        continue;
+                    const capability = estimateModelCapability(entry.model);
+                    models.push({ provider, model: entry.model, capability, band: capabilityBand(capability) });
+                }
+            }
+            models.sort((a, b) => b.capability - a.capability);
+            writeJson(res, 200, { ok: true, models: models.slice(0, 80) });
+        })();
+        return;
+    }
     // POST /api/chat — send one message { sessionId?, message, provider?, model? }.
     if (pathname === '/api/chat' && req.method === 'POST') {
         void (async () => {
@@ -6374,6 +6746,11 @@ function handleRequest(req, res) {
                 : newChatSessionId();
             const provider = typeof body?.provider === 'string' ? body.provider : undefined;
             const model = typeof body?.model === 'string' ? body.model : undefined;
+            // Strict-model pin for THIS turn (the dashboard chat's "pin this model
+            // only" switch). Scoped to the turn with AsyncLocalStorage rather than a
+            // process env write, because two sessions can run concurrently and a
+            // global mutation would leak one user's pin into the other's turn.
+            const strict = body?.strict === true;
             // WS5 (#27) — per-turn isolation and resume, from the GUI.
             //
             // Read as a strict TRI-state, because the three cases are genuinely
@@ -6482,7 +6859,7 @@ function handleRequest(req, res) {
             // Mark the failover log BEFORE the turn so a failure can report which
             // models were actually tried (same contract as the gateway).
             const attemptMark = markFailoverAttempts();
-            const result = await chatConsole.answer(sessionId, message, {
+            const result = await withStrictModel(strict, () => chatConsole.answer(sessionId, message, {
                 provider,
                 model,
                 projectContext,
@@ -6491,7 +6868,7 @@ function handleRequest(req, res) {
                 ...(worktree === undefined ? {} : { worktree }),
                 ...(keepWorktree === undefined ? {} : { keepWorktree }),
                 ...(resume === undefined ? {} : { resume }),
-            });
+            }));
             if (!result.ok) {
                 writeJson(res, 400, {
                     ok: false,
@@ -6504,6 +6881,29 @@ function handleRequest(req, res) {
             // enforced (see ChatRetryBroker). Without this the console was a dead end
             // — the reader had to wait and re-send the message themselves.
             let content = result.content ?? '';
+            // When a model was pinned WITHOUT strict mode, say plainly what happened
+            // to the pin: a turn that ran on another provider was auto-routed, and a
+            // pinned model that failed may be handed off on the next attempt. Either
+            // way the reader is told how to force the pinned model — enable strict
+            // mode — instead of discovering the switch later.
+            let routingNotice;
+            if (provider) {
+                const requested = `${provider}${model ? `/${model}` : ''}`;
+                const served = result.provider ? `${result.provider}${result.model ? `/${result.model}` : ''}` : '';
+                const substituted = Boolean(served) && result.provider !== provider;
+                if (strict) {
+                    if (result.generationFailed === true) {
+                        routingNotice =
+                            'Strict model mode is on, so the turn stopped rather than falling back to another model.';
+                    }
+                }
+                else if (substituted) {
+                    routingNotice = `Auto routing took over: this turn ran on ${served} because your pinned ${requested} was not available. To work with ${requested} only, enable strict model mode.`;
+                }
+                else if (result.generationFailed === true) {
+                    routingNotice = `Your pinned ${requested} could not complete this turn, so auto routing may hand the work to another model. To stay on this model only, enable strict model mode.`;
+                }
+            }
             // Did the offer we are about to send get a mechanism behind it? The client
             // uses this to stop offering "↻ Retry" for a turn the server is already
             // retrying on its own — a manual re-send on top of the queued one would
@@ -6535,6 +6935,7 @@ function handleRequest(req, res) {
                 followups: result.followups ?? [],
                 provider: result.provider ?? null,
                 model: result.model ?? null,
+                ...(routingNotice ? { routingNotice } : {}),
                 // WS1 — the findings this turn recorded, with the gate's verdicts, so
                 // a dashboard client reads the same wire form the CLI, the gateway and
                 // the subagent report (the GUI card is a rendering decision; the FACT
@@ -6552,6 +6953,10 @@ function handleRequest(req, res) {
                 // that sets `NUVIRA_RESUME` gets resumed turns, and a reader who is never
                 // told cannot tell a replayed turn from a fresh one.
                 ...(result.resume ? { resume: result.resume } : {}),
+                // E — the derived plan → track → verify → report artifact for this turn,
+                // so the GUI can render the trust verdict instead of inferring it from the
+                // transcript. Absent when the turn produced no non-trivial report.
+                ...(result.turnReport ? { turnReport: result.turnReport } : {}),
                 // WS5 — whether the turn declined to run, so the client labels the failure
                 // as the refusal it is instead of offering a Retry that cannot help.
                 refused: result.refused === true,