ccqa 1.31.4 → 1.33.0

package/dist/bin/ccqa.mjs

@@ -4775,6 +4775,18 @@ const PerspectiveStatusSchema = z.object({
 	target: z.string().min(1).optional()
 }).strip();
 /**
+* One step of a spec, transcribed verbatim for display. Exactly one shape per
+* step: an include step carries the block name it invokes (its params stay in
+* the spec — they are wiring, not procedure), an action step carries the
+* instruction and what it expects. Never authored or reworded here: like
+* `title`, this is a mechanical copy the next `ccqa perspectives` rewrites.
+*/
+const PerspectiveStepSchema = z.object({
+	include: z.string().min(1).optional(),
+	instruction: z.string().optional(),
+	expected: z.string().optional()
+}).strip();
+/**
 * One test case in the inventory.
 *
 * - `title` is transcribed verbatim from the spec.yaml.
@@ -4786,11 +4798,12 @@ const PerspectiveStatusSchema = z.object({
 *   steps (the opening screen, the state the test assumes, and the setup
 *   prerequisites such as which role logs in). Optional: a spec may not
 *   express all of them.
+* - `steps` is the procedure itself, transcribed verbatim (never authored —
+*   see PerspectiveStepSchema) so the hub UI can show a case in full without
+*   a repo checkout. The spec.yaml stays the single source of truth: this
+*   copy is rewritten wholesale every time the inventory is regenerated, the
+*   same way `title` is.
 * - `note` is a human-only field. Regenerating perspectives preserves it.
-*
-* The detailed test procedure and expected results are deliberately NOT
-* duplicated here — the spec.yaml steps are the single source of truth for
-* those. The Markdown view links back to the spec instead of restating them.
 */
 const PerspectiveSpecSchema = z.object({
 	specName: z.string().min(1),
@@ -4799,6 +4812,7 @@ const PerspectiveSpecSchema = z.object({
 	startScreen: z.string().optional(),
 	testCondition: z.string().optional(),
 	preconditions: z.array(z.string().min(1)).optional(),
+	steps: z.array(PerspectiveStepSchema).optional(),
 	status: PerspectiveStatusSchema,
 	changedAt: z.string().optional(),
 	note: z.string().optional()
@@ -7396,7 +7410,8 @@ const SpecVerdictSchema = z.enum([
 	"inProgress",
 	"needsRepair",
 	"rerunNeeded",
-	"verified"
+	"verified",
+	"manuallyVerified"
 ]);
 /**
 * Which hole in the deploy log made the hub assume a deploy reached this spec
@@ -7452,6 +7467,97 @@ z.object({
 /** Body of `DELETE /projects/:project/locks?profile=`. */
 const ReleaseLocksRequestSchema = z.object({ holder: z.string().min(1) });
 /**
+* A person's word that they checked a spec's behaviour by hand against the
+* deployed environment. It overrides the verdict, never the ledgers: the
+* drift entry that parked the spec stays open, so the repair loop keeps its
+* reason to fix the test, while the verdict stops asking a person for what a
+* person already did.
+*
+* Anchored to the deploy head at the moment it was recorded, so it lapses on
+* its own — a deploy reaching the spec, or the spec being edited, ends its
+* coverage the same way those end a run's (ADR-0010). One per spec: a new
+* attestation replaces the previous one.
+*/
+const AttestationSchema = z.object({
+	by: z.string().min(1),
+	at: z.string(),
+	note: z.string().optional(),
+	deployedSha: z.string().nullable()
+});
+/** The per-(project, profile) attestation document: "feature/spec" → the standing attestation. */
+const AttestationsSchema = z.object({ specs: z.record(z.string(), AttestationSchema).default({}) });
+/**
+* Why an attestation stopped covering the spec. One reason is named even when
+* several hold, in the order the checks run (coverage, then the spec's own
+* edits, then a later red run) — enough for a reader to see what to verify
+* before attesting again.
+*/
+const AttestationLapseSchema = z.enum([
+	"deployReached",
+	"cannotPlace",
+	"specEdited",
+	"newerRed"
+]);
+/** Body of `PUT /projects/:project/attestations?profile=`. */
+const PutAttestationRequestSchema = z.object({
+	spec: z.string().min(1).max(512),
+	by: z.string().min(1).max(256),
+	note: z.string().max(4e3).optional()
+});
+/** Body of `DELETE /projects/:project/attestations?profile=`. */
+const DeleteAttestationRequestSchema = z.object({ spec: z.string().min(1).max(512) });
+z.object({
+	project: z.string(),
+	profile: z.string(),
+	spec: z.string(),
+	attestation: AttestationSchema
+});
+z.object({
+	project: z.string(),
+	profile: z.string(),
+	specs: z.record(z.string(), AttestationSchema)
+});
+/**
+* A person's answer to one audit finding: the spec describes the code fine,
+* and the finding is wrong. Where an attestation speaks about the product,
+* this speaks about the *audit* — so it settles the audit axis rather than
+* the verdict, and the spec goes back to being run like any other.
+*
+* Pinned to the audit run whose finding it answers. A later audit is a new
+* observation of newer code, so it produces a new run and this stops
+* applying: the machine gets to raise the finding again, and the record of
+* the last dismissal is shown beside it rather than silently suppressing it.
+* No profile — an audit finding is about the repository, not an environment
+* (ADR-0013), which is also why this is scoped per project alone.
+*/
+const AuditDismissalSchema = z.object({
+	by: z.string().min(1),
+	at: z.string(),
+	note: z.string().min(1),
+	auditRunId: z.string(),
+	label: DriftLabelSchema,
+	headline: z.string()
+});
+/** The per-project dismissal document: "feature/spec" → the last dismissal. */
+const AuditDismissalsSchema = z.object({ specs: z.record(z.string(), AuditDismissalSchema).default({}) });
+/** Body of `PUT /projects/:project/audit-dismissals`. */
+const PutAuditDismissalRequestSchema = z.object({
+	spec: z.string().min(1).max(512),
+	by: z.string().min(1).max(256),
+	note: z.string().min(1).max(4e3)
+});
+/** Body of `DELETE /projects/:project/audit-dismissals`. */
+const DeleteAuditDismissalRequestSchema = z.object({ spec: z.string().min(1).max(512) });
+z.object({
+	project: z.string(),
+	spec: z.string(),
+	dismissal: AuditDismissalSchema
+});
+z.object({
+	project: z.string(),
+	specs: z.record(z.string(), AuditDismissalSchema)
+});
+/**
 * One spec's verdict, the two axes it was derived from, and the three ledger
 * coordinates the view shows alongside them. The coordinates are always
 * present (null when the spec has no such entry); the optional fields appear
@@ -7467,8 +7573,14 @@ const SpecRerunSchema = z.object({
 	execution: ExecutionStateSchema,
 	driftLabel: DriftLabelSchema.exclude(["UNKNOWN"]).optional(),
 	auditAssumedReached: RerunUnknownReasonSchema.optional(),
+	auditDismissed: AuditDismissalSchema.optional(),
+	auditDismissalApplied: z.boolean().optional(),
 	executionAssumedReached: RerunUnknownReasonSchema.optional(),
 	specChangedSince: z.string().optional(),
+	manual: AttestationSchema.optional(),
+	manualLapsed: AttestationSchema.extend({ because: AttestationLapseSchema }).optional(),
+	manualLapsedByDeploy: DeployRefSchema.nullable().optional(),
+	manualLapsedReason: RerunUnknownReasonSchema.optional(),
 	heldBy: SpecLockSchema.nullable(),
 	lastRun: SpecLedgerEntrySchema.nullable(),
 	lastGreen: SpecLedgerEntrySchema.nullable(),
@@ -7711,7 +7823,7 @@ async function fetchRerunReport(hubCtx, profile) {
 		throw new RunUsageError(`--only-hub-rerun-needed: could not ask the hub which specs need a re-run: ${errMessage(err)}`);
 	}
 	const parsed = RerunReportSchema.safeParse(report);
-	if (!parsed.success) throw new RunUsageError(`${FLAG$1}: this hub's re-run answer is not in a shape this ccqa understands — it is likely older than this CLI. Upgrade the hub, or select with --only-affected-by <ref> instead.`);
+	if (!parsed.success) throw new RunUsageError(`${FLAG$1}: this hub's re-run answer is not in a shape this ccqa understands — the hub and this CLI are on different versions, and either side being newer can cause it (a newer hub may answer with verdicts this CLI does not know). Align the two, or select with --only-affected-by <ref> instead.`);
 	report = parsed.data;
 	if (report.deployHead === null) throw new RunUsageError(`--only-hub-rerun-needed: no deploy has been recorded for profile "${profile}" of project "${hubCtx.project}", so nothing can be compared against. Wire \`ccqa hub deploy record\` into the deploy job, or select with --only-affected-by <ref> instead.`);
 	return {
@@ -7723,7 +7835,8 @@ const SUMMARY_ORDER$1 = rankedOrder({
 	needsRepair: 0,
 	rerunNeeded: 1,
 	inProgress: 2,
-	verified: 3
+	manuallyVerified: 3,
+	verified: 4
 });
 /**
 * Narrow `specs` to the ones the hub says are worth running.
@@ -7733,7 +7846,9 @@ const SUMMARY_ORDER$1 = rankedOrder({
 * cannot vouch for, are both as uncovered as one a deploy demonstrably
 * invalidated (ADR-0014). `needsRepair`, `inProgress` and `verified` are never
 * selected: running them repairs nothing, races something already in flight,
-* or repeats work that is still current.
+* or repeats work that is still current. `manuallyVerified` is never selected
+* either — the test is still the broken one the attestation stands in for,
+* and running it would only relabel a person's answer with a machine failure.
 */
 function selectSpecsNeedingRerun(specs, report) {
 	const counts = /* @__PURE__ */ new Map();
@@ -9224,6 +9339,20 @@ function connect(opts) {
 	error("hub token is required (--hub-token or CCQA_HUB_TOKEN)");
 	process.exit(2);
 }
+/**
+* The canonical "feature/spec" key for a CLI argument. Hub records are stored
+* and looked up under exactly this form, so an alias accepted here but kept
+* verbatim would silently never match.
+*/
+function requireSpecId(rawSpecId) {
+	try {
+		const parsed = parseSpecPath(rawSpecId);
+		return `${parsed.featureName}/${parsed.specName}`;
+	} catch (err) {
+		error(errMessage(err));
+		process.exit(2);
+	}
+}
 function validateSessionName(name) {
 	const parsed = SessionNameSchema.safeParse(name);
 	if (!parsed.success) {
@@ -9518,7 +9647,53 @@ const pushCommand = new Command("push").description("Upload the report directory
 	meta("specs", `${run.specs.passed}/${run.specs.total} passed`);
 	info(`${resolveBaseUrl(opts)}/#/runs/${run.id}`);
 }));
-const hubCommand = new Command("hub").description("Client for a ccqa hub: push run results and manage sessions/variables/prompts used by `ccqa run`. See docs/hub.md.").addCommand(pushCommand).addCommand(deployCommand).addCommand(costCommand).addCommand(sessionCommand).addCommand(varCommand).addCommand(promptCommand);
+const attestCommand = new Command("attest").argument("<feature/spec>", "Spec id, e.g. checkout/happy-path").description("Record that a person checked a spec's behaviour by hand against the deployed environment. The verdict answers manuallyVerified instead of asking a person for what a person already did — the drift ledger is untouched, so the repair loop keeps its reason to fix the test. The attestation lapses on its own when a deploy reaches the spec or the spec is edited.").requiredOption("--profile <name>", "Environment that was checked (e.g. 'stg'). The attestation is anchored to its current deploy head.").option("--by <name>", "Who checked. Required unless --revoke.").option("--note <text>", "What was checked and how — the reader deciding whether to trust it sees this.").option("--revoke", "Withdraw the spec's attestation instead of recording one.").option(...hubUrlOption).option(...hubTokenOption).option("--project <name>", "Hub project. Defaults to the current directory's name.").option("--cwd <path>", "Directory the default --project name is resolved against.").action(withHubErrors(async (rawSpecId, opts) => {
+	const project = resolveProject(opts);
+	const hub = connect(opts);
+	const specId = requireSpecId(rawSpecId);
+	if (opts.revoke) {
+		await hub.deleteAttestation(project, { profile: opts.profile }, specId);
+		header("hub attest", `${specId} revoked`);
+		return;
+	}
+	if (!opts.by) {
+		error("--by <name> is required: an attestation is a person's word, and it needs the person");
+		process.exit(2);
+	}
+	const res = await hub.putAttestation(project, { profile: opts.profile }, {
+		spec: specId,
+		by: opts.by,
+		...opts.note !== void 0 ? { note: opts.note } : {}
+	});
+	header("hub attest", specId);
+	meta("by", res.attestation.by);
+	meta("anchored to deploy", res.attestation.deployedSha ?? "(no deploy log)");
+	info("the verdict answers manuallyVerified until a deploy reaches this spec or the spec is edited");
+}));
+const dismissCommand = new Command("dismiss").argument("<feature/spec>", "Spec id, e.g. checkout/happy-path").description("Record that a person judged the spec's current audit finding wrong: the spec describes the code fine. This settles the audit axis rather than the verdict — the spec goes back to being run like any other, and the next run says whether the person was right. The dismissal is pinned to the audit run that raised the finding, so a later audit can raise it again. No --profile: a finding is about the repository, not an environment.").option("--by <name>", "Who judged it wrong. Required unless --revoke.").option("--reason <text>", "Why the finding is wrong. Required unless --revoke — this is what a mis-firing audit learns from.").option("--revoke", "Withdraw the dismissal, putting the finding back in force.").option(...hubUrlOption).option(...hubTokenOption).option("--project <name>", "Hub project. Defaults to the current directory's name.").option("--cwd <path>", "Directory the default --project name is resolved against.").action(withHubErrors(async (rawSpecId, opts) => {
+	const project = resolveProject(opts);
+	const hub = connect(opts);
+	const specId = requireSpecId(rawSpecId);
+	if (opts.revoke) {
+		await hub.deleteAuditDismissal(project, specId);
+		header("hub dismiss", `${specId} revoked`);
+		return;
+	}
+	if (!opts.by || !opts.reason) {
+		error("--by <name> and --reason <text> are both required: a dismissal is a person's correction, and it needs the person and the correction");
+		process.exit(2);
+	}
+	const res = await hub.putAuditDismissal(project, {
+		spec: specId,
+		by: opts.by,
+		note: opts.reason
+	});
+	header("hub dismiss", specId);
+	meta("by", res.dismissal.by);
+	meta("dismissed", `${res.dismissal.label} — ${res.dismissal.headline || "(no headline)"}`);
+	info("this finding no longer holds the spec back; a later audit can raise one of its own");
+}));
+const hubCommand = new Command("hub").description("Client for a ccqa hub: push run results and manage sessions/variables/prompts used by `ccqa run`. See docs/hub.md.").addCommand(pushCommand).addCommand(deployCommand).addCommand(costCommand).addCommand(sessionCommand).addCommand(varCommand).addCommand(promptCommand).addCommand(attestCommand).addCommand(dismissCommand);
 /** Loose check that a fetched session is agent-browser storage-state, mirroring loadStorageState. */
 function isStorageStateShape(state) {
 	return typeof state === "object" && state !== null && Array.isArray(state.cookies) && Array.isArray(state.origins);
@@ -17154,6 +17329,7 @@ async function buildSkeleton(tree) {
 				specName: s.specName,
 				title: meta.title,
 				summary: "",
+				...meta.steps.length > 0 ? { steps: meta.steps } : {},
 				status,
 				...lastEdit ? { changedAt: lastEdit } : {}
 			};
@@ -17227,7 +17403,8 @@ function noteKey(featureName, specName) {
 function readSpecMeta(specName, specYaml) {
 	if (specYaml === null) return {
 		title: specName,
-		mode: DEFAULT_SPEC_MODE
+		mode: DEFAULT_SPEC_MODE,
+		steps: []
 	};
 	try {
 		const parsed = parse(specYaml);
@@ -17235,16 +17412,39 @@ function readSpecMeta(specName, specYaml) {
 		const modeResult = SpecModeSchema.safeParse(parsed.mode);
 		return {
 			title,
-			mode: modeResult.success ? modeResult.data : DEFAULT_SPEC_MODE
+			mode: modeResult.success ? modeResult.data : DEFAULT_SPEC_MODE,
+			steps: transcribeSteps(parsed.steps)
 		};
 	} catch {
 		return {
 			title: specName,
-			mode: DEFAULT_SPEC_MODE
+			mode: DEFAULT_SPEC_MODE,
+			steps: []
 		};
 	}
 }
 /**
+* The spec's procedure, copied verbatim for the inventory: an include step
+* keeps only the block name (its params are wiring, not procedure), an
+* action step keeps its instruction/expected text. Anything malformed is
+* skipped — the inventory never fails over one bad step, matching how the
+* rest of this sweep treats a broken spec.
+*/
+function transcribeSteps(raw) {
+	if (!Array.isArray(raw)) return [];
+	const steps = [];
+	for (const step of raw) {
+		if (typeof step !== "object" || step === null) continue;
+		const s = step;
+		if (typeof s.include === "string" && s.include.length > 0) steps.push({ include: s.include });
+		else if (typeof s.instruction === "string" && s.instruction.length > 0) steps.push({
+			instruction: s.instruction,
+			...typeof s.expected === "string" && s.expected.length > 0 ? { expected: s.expected } : {}
+		});
+	}
+	return steps;
+}
+/**
 * Resolve a spec's generation target for coverage derivation, from its
 * already-read spec.yaml. Best-effort: an unparseable spec or a target that
 * can't be resolved (unknown id, agent-browser-only field misuse) falls back
@@ -18346,7 +18546,7 @@ function requireKey(config) {
 	return config.encryptionKey;
 }
 /** Validate the `:project`/`:profile` route params into a store scope. */
-function requireScope(ctx) {
+function requireScope$1(ctx) {
 	return {
 		project: requireSafeSegment(ctx.params.project, "project"),
 		profile: requireSafeSegment(ctx.params.profile, "profile")
@@ -18356,7 +18556,7 @@ function requireScope(ctx) {
 function createPutSessionHandler(config) {
 	return async (ctx) => {
 		const key = requireKey(config);
-		const scope = requireScope(ctx);
+		const scope = requireScope$1(ctx);
 		const name = requireSafeSegment(ctx.params.name, "name");
 		const body = await readBody(ctx.req, MAX_SECRET_BODY_BYTES);
 		const blob = encodeEncryptedBlob(encrypt(new Uint8Array(body), key));
@@ -18368,7 +18568,7 @@ function createPutSessionHandler(config) {
 /** GET /api/v1/projects/:project/sessions/:profile — metadata only (names + timestamps). */
 function createListSessionsHandler(config) {
 	return async (ctx) => {
-		const scope = requireScope(ctx);
+		const scope = requireScope$1(ctx);
 		const entries = await config.store.list(scope);
 		sendJson(ctx.res, 200, { sessions: entries.map((e) => ({
 			name: e.name,
@@ -18385,7 +18585,7 @@ function createListSessionsHandler(config) {
 function createGetSessionHandler(config) {
 	return async (ctx) => {
 		const key = requireKey(config);
-		const scope = requireScope(ctx);
+		const scope = requireScope$1(ctx);
 		const name = requireSafeSegment(ctx.params.name, "name");
 		const stored = await config.store.get(scope, name);
 		if (!stored) throw new HttpError(404, "not_found", `session "${name}" not found for ${scope.project}/${scope.profile}`);
@@ -18396,7 +18596,7 @@ function createGetSessionHandler(config) {
 /** DELETE /api/v1/projects/:project/sessions/:profile/:name */
 function createDeleteSessionHandler(config) {
 	return async (ctx) => {
-		const scope = requireScope(ctx);
+		const scope = requireScope$1(ctx);
 		const name = requireSafeSegment(ctx.params.name, "name");
 		await config.store.delete(scope, name);
 		ctx.res.statusCode = 204;
@@ -18407,7 +18607,7 @@ function createDeleteSessionHandler(config) {
 function createPutVariableHandler(config) {
 	return async (ctx) => {
 		const key = requireKey(config);
-		const scope = requireScope(ctx);
+		const scope = requireScope$1(ctx);
 		const name = requireSafeSegment(ctx.params.name, "name");
 		const body = await readBody(ctx.req, MAX_SECRET_BODY_BYTES);
 		const parsed = PutVariableRequestSchema.safeParse(JSON.parse(body.toString("utf8") || "{}"));
@@ -18427,7 +18627,7 @@ function createPutVariableHandler(config) {
 */
 function createListVariablesHandler(config) {
 	return async (ctx) => {
-		const scope = requireScope(ctx);
+		const scope = requireScope$1(ctx);
 		const includeValues = ctx.url.searchParams.get("include") === "values";
 		const key = includeValues ? requireKey(config) : config.encryptionKey;
 		const entries = await config.store.list(scope);
@@ -18462,7 +18662,7 @@ function createListVariablesHandler(config) {
 /** DELETE /api/v1/projects/:project/variables/:profile/:name */
 function createDeleteVariableHandler(config) {
 	return async (ctx) => {
-		const scope = requireScope(ctx);
+		const scope = requireScope$1(ctx);
 		const name = requireSafeSegment(ctx.params.name, "name");
 		await config.store.delete(scope, name);
 		ctx.res.statusCode = 204;
@@ -18801,7 +19001,7 @@ function createGetAuditNeedHandler(storage) {
 //#endregion
 //#region src/hub/api/handlers/locks.ts
 /** A spec-key list and three short strings; nothing here should approach this. */
-const MAX_BODY_BYTES$3 = 1024 * 1024;
+const MAX_BODY_BYTES$5 = 1024 * 1024;
 /**
 * POST /api/v1/projects/:project/locks?profile=
 *
@@ -18815,7 +19015,7 @@ function createAcquireLocksHandler(storage) {
 	return async (ctx) => {
 		const project = requireSafeSegment(ctx.params.project, "project");
 		const profile = requireProfileParam(ctx.url);
-		const body = await readJsonBody(ctx.req, MAX_BODY_BYTES$3, AcquireLocksRequestSchema, "lock request");
+		const body = await readJsonBody(ctx.req, MAX_BODY_BYTES$5, AcquireLocksRequestSchema, "lock request");
 		let result = {
 			granted: [],
 			denied: []
@@ -18844,7 +19044,7 @@ function createReleaseLocksHandler(storage) {
 	return async (ctx) => {
 		const project = requireSafeSegment(ctx.params.project, "project");
 		const profile = requireProfileParam(ctx.url);
-		const body = await readJsonBody(ctx.req, MAX_BODY_BYTES$3, ReleaseLocksRequestSchema, "release request");
+		const body = await readJsonBody(ctx.req, MAX_BODY_BYTES$5, ReleaseLocksRequestSchema, "release request");
 		await storage.locks.update(project, profile, (current) => releaseAll(current, body.holder));
 		ctx.res.writeHead(204).end();
 	};
@@ -18857,7 +19057,7 @@ function createReleaseLocksHandler(storage) {
 * 5000 keys of 256 `\uXXXX`-escaped characters — so a conforming client is
 * never answered 413 by a limit the documented bounds don't mention.
 */
-const MAX_BODY_BYTES$2 = 8 * 1024 * 1024;
+const MAX_BODY_BYTES$4 = 8 * 1024 * 1024;
 function requireAckKey(ctx) {
 	return {
 		project: requireSafeSegment(ctx.params.project, "project"),
@@ -18884,7 +19084,7 @@ function createGetAckHandler(storage) {
 function createPutAckHandler(storage) {
 	return async (ctx) => {
 		const key = requireAckKey(ctx);
-		const body = await readJsonBody(ctx.req, MAX_BODY_BYTES$2, PutAckRequestSchema, "ack body");
+		const body = await readJsonBody(ctx.req, MAX_BODY_BYTES$4, PutAckRequestSchema, "ack body");
 		const ack = await storage.acks.put(key.project, key.profile, key.name, body.keys);
 		sendJson(ctx.res, 200, {
 			...key,
@@ -18893,6 +19093,157 @@ function createPutAckHandler(storage) {
 	};
 }
 //#endregion
+//#region src/hub/api/handlers/attestations.ts
+/** Far above the largest body `PutAttestationRequestSchema`'s bounds admit. */
+const MAX_BODY_BYTES$3 = 64 * 1024;
+function requireScope(ctx) {
+	return {
+		project: requireSafeSegment(ctx.params.project, "project"),
+		profile: requireProfileParam(ctx.url)
+	};
+}
+/**
+* GET /api/v1/projects/:project/attestations?profile= — the raw document,
+* standing and lapsed alike. Whether one still covers its spec is `/rerun`'s
+* answer; this exists so a lapsed attestation can still be found and revoked.
+*/
+function createGetAttestationsHandler(storage) {
+	return async (ctx) => {
+		const scope = requireScope(ctx);
+		const doc = await storage.attestations.get(scope.project, scope.profile);
+		sendJson(ctx.res, 200, {
+			...scope,
+			specs: doc.specs
+		});
+	};
+}
+/**
+* PUT /api/v1/projects/:project/attestations?profile= — record that a person
+* checked a spec by hand. The hub stamps the time and the profile's deploy
+* head: the anchor must be what the hub knows was deployed at this moment,
+* not what the caller believes. Replaces any previous attestation for the
+* spec.
+*/
+function createPutAttestationHandler(storage) {
+	return async (ctx) => {
+		const scope = requireScope(ctx);
+		const [body, head, targets] = await Promise.all([
+			readJsonBody(ctx.req, MAX_BODY_BYTES$3, PutAttestationRequestSchema, "attestation body"),
+			storage.deploys.head(scope.project, scope.profile),
+			requireSpecTargets(storage.perspectives, scope.project, "what can be attested")
+		]);
+		if (!targets.some((target) => target.key === body.spec)) throw new HttpError(400, "unknown_spec", `spec "${body.spec}" is not in project "${scope.project}"'s perspectives document — attest with the canonical feature/spec key, or push \`ccqa perspectives\` first`);
+		const attestation = {
+			by: body.by,
+			at: (/* @__PURE__ */ new Date()).toISOString(),
+			...body.note !== void 0 ? { note: body.note } : {},
+			deployedSha: head?.sha ?? null
+		};
+		await storage.attestations.update(scope.project, scope.profile, (current) => ({ specs: {
+			...current.specs,
+			[body.spec]: attestation
+		} }));
+		sendJson(ctx.res, 200, {
+			...scope,
+			spec: body.spec,
+			attestation
+		});
+	};
+}
+/**
+* DELETE /api/v1/projects/:project/attestations?profile= — revoke a spec's
+* attestation. Deleting one that does not exist is 200 like deleting one that
+* does: the caller asked for its absence, and it is absent.
+*/
+function createDeleteAttestationHandler(storage) {
+	return async (ctx) => {
+		const scope = requireScope(ctx);
+		const body = await readJsonBody(ctx.req, MAX_BODY_BYTES$3, DeleteAttestationRequestSchema, "attestation body");
+		await storage.attestations.update(scope.project, scope.profile, (current) => {
+			const { [body.spec]: _, ...rest } = current.specs;
+			return { specs: rest };
+		});
+		sendJson(ctx.res, 200, { removed: body.spec });
+	};
+}
+//#endregion
+//#region src/hub/api/handlers/audit-dismissals.ts
+/** Far above the largest body `PutAuditDismissalRequestSchema`'s bounds admit. */
+const MAX_BODY_BYTES$2 = 64 * 1024;
+/**
+* GET /api/v1/projects/:project/audit-dismissals — the raw document,
+* whether or not each entry still answers the spec's current finding. No
+* `?profile=`: a finding is about the repository (see `AuditDismissalSchema`).
+*/
+function createGetAuditDismissalsHandler(storage) {
+	return async (ctx) => {
+		const project = requireSafeSegment(ctx.params.project, "project");
+		const doc = await storage.auditDismissals.get(project);
+		sendJson(ctx.res, 200, {
+			project,
+			specs: doc.specs
+		});
+	};
+}
+/**
+* PUT /api/v1/projects/:project/audit-dismissals — record that a person
+* judged the spec's current audit finding wrong.
+*
+* The finding being answered is read from the ledger rather than taken from
+* the caller: a dismissal must name the run and the label it answers, and
+* only the hub knows which finding is current. A spec with no open finding is
+* a 400 — there is nothing to dismiss, and accepting it would write a record
+* that never applies to anything.
+*
+* The guard stops there on purpose. `/rerun` applies a dismissal only while
+* the audit is also *current* for the profile being asked about, and that is
+* a per-profile question this endpoint has no profile to ask it of (a finding
+* is about the repository, so the dismissal is project-scoped). A dismissal
+* written while a deploy has overtaken the audit is harmless: the next audit
+* supersedes the finding, and the record with it.
+*/
+function createPutAuditDismissalHandler(storage) {
+	return async (ctx) => {
+		const project = requireSafeSegment(ctx.params.project, "project");
+		const [body, ledger] = await Promise.all([readJsonBody(ctx.req, MAX_BODY_BYTES$2, PutAuditDismissalRequestSchema, "dismissal body"), storage.driftLedger.getMerged(project)]);
+		const entry = ledger.specs[body.spec];
+		if (!entry || entry.label === null) throw new HttpError(400, "no_open_finding", `spec "${body.spec}" has no open audit finding in project "${project}" — there is nothing to dismiss`);
+		const dismissal = {
+			by: body.by,
+			at: (/* @__PURE__ */ new Date()).toISOString(),
+			note: body.note,
+			auditRunId: entry.runId,
+			label: entry.label,
+			headline: entry.headline ?? ""
+		};
+		await storage.auditDismissals.update(project, (current) => ({ specs: {
+			...current.specs,
+			[body.spec]: dismissal
+		} }));
+		sendJson(ctx.res, 200, {
+			project,
+			spec: body.spec,
+			dismissal
+		});
+	};
+}
+/**
+* DELETE /api/v1/projects/:project/audit-dismissals — withdraw a dismissal,
+* putting the audit's finding back in force. Deleting one that does not exist
+* is 200: the caller asked for its absence, and it is absent.
+*/
+function createDeleteAuditDismissalHandler(storage) {
+	return async (ctx) => {
+		const project = requireSafeSegment(ctx.params.project, "project");
+		const body = await readJsonBody(ctx.req, MAX_BODY_BYTES$2, DeleteAuditDismissalRequestSchema, "dismissal body");
+		await storage.auditDismissals.update(project, (current) => {
+			const { [body.spec]: _, ...rest } = current.specs;
+			return { specs: rest };
+		});
+		sendJson(ctx.res, 200, { removed: body.spec });
+	};
+}
+//#endregion
 //#region src/hub/api/handlers/spend.ts
 /** One entry is a handful of short fields; anything larger is a malformed client. */
 const MAX_BODY_BYTES$1 = 4 * 1024;
@@ -18965,7 +19316,7 @@ function specMovedSince(changedAt, baselineSha, baselineAt, deployTimes) {
 	return changedAt > (baselineSha && deployTimes.get(baselineSha) || baselineAt) ? changedAt : null;
 }
 function computeRerun(input) {
-	const { specs, ledger, log, touchIndex, drift, locks, now } = input;
+	const { specs, ledger, log, touchIndex, drift, locks, attestations, dismissals, now } = input;
 	const range = buildRange(log, touchIndex);
 	const deployTimes = deployedAt(log);
 	const out = {};
@@ -18978,16 +19329,35 @@ function computeRerun(input) {
 		let audit = auditState(drift, spec.key, range);
 		let execution = executionState(coords, (sha) => freshness(sha, spec.key, range));
 		const driftEntry = drift.specs[spec.key];
+		const dismissal = dismissals.specs[spec.key];
+		const dismissed = dismissal !== void 0 && driftEntry !== void 0 && dismissal.auditRunId === driftEntry.runId && dismissal.label === driftEntry.label && (audit.audit === "drifted" || audit.audit === "undecided");
+		if (dismissed) audit = { audit: "clean" };
 		const auditMoved = specMovedSince(spec.changedAt, driftEntry?.gitHead ?? null, driftEntry?.at ?? "", deployTimes);
 		const runMoved = specMovedSince(spec.changedAt, coords.lastRun?.deployedSha ?? null, coords.lastRun?.at ?? "", deployTimes);
 		if (auditMoved && audit.audit !== "due") audit = { audit: "due" };
 		if (runMoved && execution.execution === "passed") execution = { execution: "stale" };
 		const held = heldBy(locks, spec.key, now);
+		let verdict = decide(audit.audit, execution.execution, held);
+		const manualState = readAttestation(attestations.specs[spec.key], spec, coords.lastRed, range, log, deployTimes);
+		if (manualState?.kind === "covers" && !held && verdict !== "verified") verdict = "manuallyVerified";
 		out[spec.key] = {
-			verdict: decide(audit.audit, execution.execution, held),
+			verdict,
 			...auditMoved || runMoved ? { specChangedSince: auditMoved ?? runMoved } : {},
 			...audit,
 			...execution,
+			...dismissal ? {
+				auditDismissed: dismissal,
+				auditDismissalApplied: dismissed
+			} : {},
+			...manualState?.kind === "covers" ? { manual: manualState.attest } : {},
+			...manualState?.kind === "lapsed" ? {
+				manualLapsed: {
+					...manualState.attest,
+					because: manualState.because
+				},
+				...manualState.because === "deployReached" ? { manualLapsedByDeploy: manualState.byDeploy } : {},
+				...manualState.reason ? { manualLapsedReason: manualState.reason } : {}
+			} : {},
 			heldBy: held,
 			...coords
 		};
@@ -18995,6 +19365,50 @@ function computeRerun(input) {
 	return out;
 }
 /**
+* Does the attestation still speak for what is deployed? Checked in the order
+* the lapse enum documents: deploy coverage first (a sha the log cannot place
+* reads as reached, ADR-0014, with the hole kept as an annotation), then the
+* spec's own edits — compared against when the person looked, because they
+* read the spec as it stood that moment, which `specMovedSince` covers via a
+* null baseline sha — then a red run recorded after them, which is newer
+* information than their word. The null-sha case is the profile that had no
+* deploy log when they checked: their word covers exactly as long as that
+* stays true.
+*/
+function readAttestation(attest, spec, lastRed, range, log, deployTimes) {
+	if (!attest) return null;
+	const coverage = attest.deployedSha === null ? log.entries.length === 0 ? { kind: "current" } : {
+		kind: "unanswerable",
+		reason: "unknownDeployedSha"
+	} : freshness(attest.deployedSha, spec.key, range);
+	if (coverage.kind === "touched") return {
+		kind: "lapsed",
+		attest,
+		because: "deployReached",
+		byDeploy: coverage.touchedByDeploy
+	};
+	if (coverage.kind === "unanswerable") return {
+		kind: "lapsed",
+		attest,
+		because: "cannotPlace",
+		reason: coverage.reason
+	};
+	if (specMovedSince(spec.changedAt, null, attest.at, deployTimes)) return {
+		kind: "lapsed",
+		attest,
+		because: "specEdited"
+	};
+	if (lastRed !== null && lastRed.at > attest.at) return {
+		kind: "lapsed",
+		attest,
+		because: "newerRed"
+	};
+	return {
+		kind: "covers",
+		attest
+	};
+}
+/**
 * Axis 1, derived from the same freshness answer `--only-hub-audit-needed`
 * reads. The label only speaks once the audit is known to be current: a
 * verdict about an older commit says nothing about the one running now.
@@ -19098,13 +19512,15 @@ function createGetRerunHandler(storage) {
 	return async (ctx) => {
 		const project = requireSafeSegment(ctx.params.project, "project");
 		const profile = requireProfileParam(ctx.url);
-		const [specs, ledger, log, touchIndex, drift, locks] = await Promise.all([
+		const [specs, ledger, log, touchIndex, drift, locks, attestations, dismissals] = await Promise.all([
 			requireSpecTargets(storage.perspectives, project, "which specs need a re-run"),
 			storage.ledger.getMerged(project, profile),
 			storage.deploys.getLog(project, profile),
 			storage.deploys.getTouchIndex(project, profile),
 			storage.driftLedger.getMerged(project),
-			storage.locks.get(project, profile)
+			storage.locks.get(project, profile),
+			storage.attestations.get(project, profile),
+			storage.auditDismissals.get(project)
 		]);
 		const head = log.entries[log.entries.length - 1];
 		sendJson(ctx.res, 200, {
@@ -19118,6 +19534,8 @@ function createGetRerunHandler(storage) {
 				touchIndex,
 				drift,
 				locks,
+				attestations,
+				dismissals,
 				now: /* @__PURE__ */ new Date()
 			})
 		});
@@ -19842,6 +20260,7 @@ const HTML_BODY = `
               <button class="fchip" id="persp-chip-needsrepair" data-f="needsRepair" aria-pressed="false" type="button"><span data-i18n="perspectives.rerun.state.needsRepair">Needs repair</span><span class="fcount"></span></button>
               <button class="fchip" id="persp-chip-rerunneeded" data-f="rerunNeeded" aria-pressed="false" type="button"><span data-i18n="perspectives.rerun.state.rerunNeeded">Re-run needed</span><span class="fcount"></span></button>
               <button class="fchip" id="persp-chip-inprogress" data-f="inProgress" aria-pressed="false" type="button"><span data-i18n="perspectives.rerun.state.inProgress">In progress</span><span class="fcount"></span></button>
+              <button class="fchip" id="persp-chip-manuallyverified" data-f="manuallyVerified" aria-pressed="false" type="button"><span data-i18n="perspectives.rerun.state.manuallyVerified">Manually verified</span><span class="fcount"></span></button>
               <button class="fchip" id="persp-chip-verified" data-f="verified" aria-pressed="false" type="button"><span data-i18n="perspectives.rerun.state.verified">Verified</span><span class="fcount"></span></button>
             </div>
             <div class="spacer"></div>
@@ -20567,6 +20986,9 @@ const CSS = `
   .sg-audit-undecided { background: var(--info); }
   .sg-verified, .sg-audit-clean, .sg-exec-passed { background: var(--pass); }
   .sg-inprogress, .sg-audit-due, .sg-exec-never { background: var(--muted-2); }
+  /* A person's word, not the machine's — kept off the pass/fail palette both
+     axes share so it never reads as either one. */
+  .sg-manual { background: var(--violet); }
 
   .search { flex: 1; min-width: 200px; max-width: 340px; display: flex; align-items: center; gap: 7px; border: 1px solid var(--border-strong); border-radius: var(--radius-sm); padding: 0 10px; height: 32px; background: var(--surface); }
   .search svg { width: 15px; height: 15px; flex: none; color: var(--muted-2); }
@@ -20605,6 +21027,11 @@ const CSS = `
   .badge.rr-unknown .d { background: var(--info); }
   .badge.rr-none { background: var(--surface-3); color: var(--muted); border-color: var(--border); }
   .badge.rr-none .d { background: var(--muted); }
+  /* A person's attestation, not the audit/run pipeline's own verdict — kept
+     off that palette (rr-repair/rr-needed/rr-none/passed) the same way
+     sg-manual is kept off the summary bar's. */
+  .badge.rr-manual { background: var(--violet-bg); color: var(--violet); border-color: var(--violet-border); }
+  .badge.rr-manual .d { background: var(--violet); }
   .cellsub { display: block; margin-top: 3px; max-width: 260px; color: var(--muted); font-size: 11.5px; line-height: 1.45; }
   .graded-mark { color: var(--fg-dim); font-weight: 600; }
   .cellsub a { color: var(--muted); text-decoration: none; border-bottom: 1px dotted var(--border-strong); }
@@ -20660,6 +21087,11 @@ const CSS = `
   .d-paths { display: flex; flex-wrap: wrap; gap: 6px; }
   .d-paths code { white-space: nowrap; }
   .d-prose + .d-paths { margin-top: 6px; }
+  .manual-attest { margin-top: 14px; }
+  .steps-box { margin-top: 14px; max-width: 900px; }
+  .steps-box .slabel { font-size: 12px; color: var(--muted); margin-bottom: 4px; }
+  .d-steps { margin: 4px 0 0; padding-left: 18px; display: flex; flex-direction: column; gap: 10px; font-size: 13px; color: var(--fg-dim); white-space: pre-line; }
+  .d-steps .step-expected { display: block; margin-top: 2px; font-size: 12.5px; }
   .notebox { margin-top: 14px; max-width: 900px; }
   .notebox .nlabel { font-size: 12px; color: var(--muted); margin-bottom: 4px; }
   .notebox textarea { width: 100%; min-height: 54px; resize: vertical; font: inherit; font-size: 13px; color: var(--fg-dim); background: var(--surface); border: 1px solid var(--border-strong); border-radius: var(--radius-sm); padding: 8px 10px; }
@@ -20667,6 +21099,12 @@ const CSS = `
   .notebox .nstatus { font-size: 12px; color: var(--muted); }
   .notebox .nstatus.ok { color: var(--pass); }
   .notebox .nstatus.err { color: var(--fail); }
+  /* The inline form an audit-dismissal or environment-attestation button
+     expands into, in place of the two window.prompt() calls this replaces. */
+  .override-form { margin-top: 10px; max-width: 480px; display: flex; flex-direction: column; gap: 10px; }
+  .override-form textarea { width: 100%; min-height: 54px; resize: vertical; font: inherit; font-size: 13px; color: var(--fg-dim); background: var(--surface); border: 1px solid var(--border-strong); border-radius: var(--radius-sm); padding: 8px 10px; }
+  .override-form .of-act { display: flex; align-items: center; gap: 8px; }
+  .override-form .of-hint { font-size: 12px; color: var(--muted); max-width: 62ch; line-height: 1.5; }
 
   @media (max-width: 900px) { .app { grid-template-columns: 1fr; } .sidebar { display: none; } .logo .wm { display: none; } .split { grid-template-columns: 1fr; } .rd-head .meta { margin-left: 0; } }
   @media (max-width: 700px) { .prompt-grid { grid-template-columns: 1fr; } .prompt-diff { grid-template-columns: 1fr; } }
@@ -20700,6 +21138,7 @@ const CLIENT_JS = `
   var THEME_KEY = "ccqa-hub-theme";
   var PROJECT_KEY = "ccqa-hub-project";
   var PROFILES_KEY = "ccqa-hub-profiles";
+  var ATTEST_BY_KEY = "ccqa-attest-by";
 
   // ── i18n ──────────────────────────────────────────────────────────────
   // Chrome + labels only. Model output (headline/recommendation/reasoning) is
@@ -20788,6 +21227,8 @@ const CLIENT_JS = `
       "perspectives.ov.cases": "cases", "perspectives.ov.features": "features",
       "perspectives.d.preconditions": "Preconditions", "perspectives.d.startScreen": "Start screen",
       "perspectives.d.testCondition": "Condition", "perspectives.d.spec": "spec",
+      "perspectives.d.steps": "Steps", "perspectives.d.stepInclude": "Include: {name}",
+      "perspectives.d.stepExpected": "Expected:",
       "perspectives.note.label": "Note",
       "perspectives.note.placeholder": "Notes about this case…",
       "perspectives.note.saved": "Saved",
@@ -20800,6 +21241,7 @@ const CLIENT_JS = `
       "perspectives.rerun.state.needsRepair": "Needs repair",
       "perspectives.rerun.state.rerunNeeded": "Re-run needed",
       "perspectives.rerun.state.inProgress": "In progress",
+      "perspectives.rerun.state.manuallyVerified": "Manually verified",
       "perspectives.rerun.state.verified": "Verified",
       "perspectives.rerun.vsDeploy": "judged against deploy",
       "perspectives.rerun.noDeployHead": "no deploy recorded for this profile",
@@ -20835,6 +21277,29 @@ const CLIENT_JS = `
       "perspectives.rerun.noDeployLogBanner": "No deploy has been recorded for profile {profile}, so no case can be judged. Wire ccqa hub deploy record into the deploy job for this environment.",
       "perspectives.rerun.deployHead": "deploy head",
       "perspectives.drift.graded": "confirmed",
+      "perspectives.manual.revokeButton": "Revoke manual verification",
+      "perspectives.manual.envButton": "If the environment issue is resolved, use this",
+      "perspectives.manual.confirmRevoke": "Revoke the manual verification for this case?",
+      "perspectives.manual.error": "Could not save — retry",
+      "perspectives.manual.verifiedBy": "{by} manually verified this ({at})",
+      "perspectives.manual.lapsed.deployReached": "the manual verification lapsed when a deploy reached this case",
+      "perspectives.manual.lapsed.deployReachedNamed": "the manual verification lapsed when deploy {sha} reached this case ({at})",
+      "perspectives.manual.lapsed.cannotPlace": "the manual verification lapsed — its baseline deploy could not be placed in the log",
+      "perspectives.manual.lapsed.specEdited": "the manual verification lapsed when the spec was edited",
+      "perspectives.manual.lapsed.newerRed": "the manual verification lapsed after a later run failed",
+      "perspectives.manual.lapsed.unrecognized": "the manual verification lapsed for a reason this UI does not recognise",
+      "perspectives.dismiss.offerButton": "If the test spec was fine, use this",
+      "perspectives.dismiss.revokeButton": "Undo the dismissal",
+      "perspectives.dismiss.confirmRevoke": "Undo the dismissal for this case?",
+      "perspectives.dismiss.activeNote": "Audit finding “{headline}” was dismissed by {by} as a false positive ({at}) — “{note}”. The next run will settle it.",
+      "perspectives.dismiss.priorNote": "This finding was previously dismissed by {by} ({at}) — “{note}”.",
+      "perspectives.override.byLabel": "Verified by",
+      "perspectives.override.reasonLabel": "Reason (required)",
+      "perspectives.override.noteLabel": "What was resolved, and how you checked (required)",
+      "perspectives.override.submit": "Record",
+      "perspectives.override.cancel": "Never mind",
+      "perspectives.override.dismissHint": "Overrides the audit finding and closes the case. The verdict moves to “re-run needed”, and the next run settles it.",
+      "perspectives.override.envHint": "The failure stays on record, but the verdict becomes “manually verified” without waiting for a re-run. It lapses once a deploy reaches this spec.",
       "prompt.card.record": "Recording browser actions",
       "prompt.card.live": "Live run (AI-driven)",
       "prompt.card.playwright": "Playwright test generation",
@@ -20952,6 +21417,8 @@ const CLIENT_JS = `
       "perspectives.ov.cases": "ケース", "perspectives.ov.features": "機能",
       "perspectives.d.preconditions": "前提条件", "perspectives.d.startScreen": "開始画面",
       "perspectives.d.testCondition": "実行条件", "perspectives.d.spec": "spec",
+      "perspectives.d.steps": "手順", "perspectives.d.stepInclude": "ブロック: {name}",
+      "perspectives.d.stepExpected": "期待結果:",
       "perspectives.note.label": "note",
       "perspectives.note.placeholder": "このケースについてのメモ…",
       "perspectives.note.saved": "保存しました",
@@ -20964,6 +21431,7 @@ const CLIENT_JS = `
       "perspectives.rerun.state.needsRepair": "修正待ち",
       "perspectives.rerun.state.rerunNeeded": "要再実行",
       "perspectives.rerun.state.inProgress": "進行中",
+      "perspectives.rerun.state.manuallyVerified": "手動確認済み",
       "perspectives.rerun.state.verified": "検証済み",
       "perspectives.rerun.vsDeploy": "判定基準: デプロイ",
       "perspectives.rerun.noDeployHead": "このプロファイルにはデプロイの記録がありません",
@@ -20999,6 +21467,29 @@ const CLIENT_JS = `
       "perspectives.rerun.noDeployLogBanner": "プロファイル {profile} にデプロイの記録がないため、どのケースも判定できません。この環境のデプロイジョブに ccqa hub deploy record を組み込んでください。",
       "perspectives.rerun.deployHead": "最新デプロイ",
       "perspectives.drift.graded": "人が確認",
+      "perspectives.manual.revokeButton": "手動確認を取り消す",
+      "perspectives.manual.envButton": "環境要因が解消した場合はこちら",
+      "perspectives.manual.confirmRevoke": "このケースの手動確認を取り消しますか？",
+      "perspectives.manual.error": "保存に失敗しました — 再試行してください",
+      "perspectives.manual.verifiedBy": "{by}さんが手動確認（{at}）",
+      "perspectives.manual.lapsed.deployReached": "手動確認はデプロイの到達により失効",
+      "perspectives.manual.lapsed.deployReachedNamed": "手動確認はデプロイ {sha}（{at}）の到達により失効",
+      "perspectives.manual.lapsed.cannotPlace": "手動確認は基準デプロイをログで特定できず失効",
+      "perspectives.manual.lapsed.specEdited": "手動確認はspecの編集により失効",
+      "perspectives.manual.lapsed.newerRed": "手動確認は直後の実行失敗により失効",
+      "perspectives.manual.lapsed.unrecognized": "このUIが認識できない理由により手動確認が失効",
+      "perspectives.dismiss.offerButton": "テスト仕様に問題がなかった場合はこちら",
+      "perspectives.dismiss.revokeButton": "棄却を取り消す",
+      "perspectives.dismiss.confirmRevoke": "このケースの棄却を取り消しますか？",
+      "perspectives.dismiss.activeNote": "監査指摘「{headline}」は{by}が誤検知として棄却（{at}）—「{note}」。次の実行が裁定します。",
+      "perspectives.dismiss.priorNote": "前回この指摘は{by}が棄却しています（{at}）—「{note}」",
+      "perspectives.override.byLabel": "確認した人",
+      "perspectives.override.reasonLabel": "理由（必須）",
+      "perspectives.override.noteLabel": "解消と確認の内容（必須）",
+      "perspectives.override.submit": "記録する",
+      "perspectives.override.cancel": "やめる",
+      "perspectives.override.dismissHint": "監査の指摘を上書きして台帳を閉じます。判定は「要再実行」に移り、次の実行が正否を裁定します。",
+      "perspectives.override.envHint": "失敗の記録は残したまま、判定は再実行を待たず「手動確認済み」になります。次のデプロイがこの spec に届くと失効します。",
       "prompt.card.record": "ブラウザ操作の記録",
       "prompt.card.live": "ライブ実行（AI操作）",
       "prompt.card.playwright": "Playwrightテスト生成",
@@ -21132,6 +21623,17 @@ const CLIENT_JS = `
     try { window.localStorage.removeItem(PROJECT_KEY); }
     catch (e) { console.warn("ccqa hub: could not clear stored project:", e); }
   }
+
+  // Remembered across attestations so the prompt's default is whoever last
+  // used this browser, not a blank field every time.
+  function loadAttestBy() {
+    try { return window.localStorage.getItem(ATTEST_BY_KEY) || ""; }
+    catch (e) { return ""; }
+  }
+  function storeAttestBy(by) {
+    try { window.localStorage.setItem(ATTEST_BY_KEY, by); }
+    catch (e) { /* non-fatal: next prompt just starts blank again */ }
+  }
   function loadProfileMap() {
     try {
       var raw = window.localStorage.getItem(PROFILES_KEY);
@@ -23080,6 +23582,18 @@ const CLIENT_JS = `
       "/rerun?profile=" + encodeURIComponent(state.profile);
   }
 
+  function attestationsPath() {
+    return "/api/v1/projects/" + encodeURIComponent(state.project) +
+      "/attestations?profile=" + encodeURIComponent(state.profile);
+  }
+
+  // A person's answer to an audit finding, not an environment: the finding is
+  // about the repository, not a deployed profile, so this carries no
+  // ?profile= (unlike attestationsPath above).
+  function auditDismissalsPath() {
+    return "/api/v1/projects/" + encodeURIComponent(state.project) + "/audit-dismissals";
+  }
+
   // Resolves { report } or { note } and never rejects: a hub that predates
   // the endpoint costs only the columns it feeds, not the whole tab. A 404
   // here can only mean "no such route" — the endpoint's own 404 is "the
@@ -23158,6 +23672,37 @@ const CLIENT_JS = `
     return text === prefix + reason ? t(prefix + "unrecognized") : text;
   }
 
+  // Who attested and when, plus their note if they left one — the whole
+  // reason a "manuallyVerified" verdict has no evidence row of its own.
+  function manualAttestationText(manual) {
+    var text = t("perspectives.manual.verifiedBy").replace("{by}", manual.by).replace("{at}", relTime(manual.at));
+    return manual.note ? text + " — " + manual.note : text;
+  }
+
+  // An attestation that no longer covers what is deployed, named alongside
+  // whatever the current verdict's own reason is (rerunCellWhy appends this)
+  // rather than replacing it — the person deciding whether to attest again
+  // needs both: what the axes say now, and that a person's word used to
+  // stand in for it. deployReached is the only reason with a named cause
+  // (manualLapsedByDeploy) to add when the log could confirm one.
+  function rerunManualLapseText(rr) {
+    var lapsed = rr && rr.manualLapsed;
+    if (!lapsed) return null;
+    if (lapsed.because === "deployReached") {
+      var deploy = rr.manualLapsedByDeploy;
+      return deploy
+        ? t("perspectives.manual.lapsed.deployReachedNamed").replace("{sha}", shortSha(deploy.sha)).replace("{at}", relTime(deploy.at))
+        : t("perspectives.manual.lapsed.deployReached");
+    }
+    if (lapsed.because === "cannotPlace" && rr.manualLapsedReason) {
+      // The same per-hole vocabulary the axes' assumed-reached annotations
+      // use — an empty deploy log and an unjudged range call for different
+      // next actions, so the shrug names which hole it is.
+      return t("perspectives.manual.lapsed.cannotPlace") + " (" + rerunReasonText("perspectives.rerun.why.", rr.manualLapsedReason) + ")";
+    }
+    return rerunReasonText("perspectives.manual.lapsed.", lapsed.because);
+  }
+
   // Every verdict that carries no evidence row explains itself here, in the
   // actionable phrasing the detail panel wants. decide() checks heldBy before
   // the audit axis, so a spec another job already holds must be explained by
@@ -23177,6 +23722,7 @@ const CLIENT_JS = `
         ? rerunReasonText("perspectives.rerun.fix.", rr.auditAssumedReached)
         : t("perspectives.rerun.inProgressHint");
     }
+    if (rr.verdict === "manuallyVerified" && rr.manual) return manualAttestationText(rr.manual);
     return rerunReasonText("perspectives.rerun.fix.", rr.verdict);
   }
 
@@ -23195,16 +23741,23 @@ const CLIENT_JS = `
   // rather than claiming a deploy matched it.
   function rerunCellWhy(rr) {
     var head = perspState.rerun && perspState.rerun.deployHead;
+    var why;
     if (rr.verdict === "rerunNeeded") {
-      if (rr.executionAssumedReached) return rerunReasonText("perspectives.rerun.why.", rr.executionAssumedReached);
-      if (!rr.touchedBy || !rr.touchedBy.length) return t("perspectives.rerun.touchedUnknown");
-      return t("perspectives.rerun.touchedCount").replace("{n}", String(rr.touchedBy.length));
-    }
-    if (rr.verdict === "verified") {
-      if (!head) return t("perspectives.rerun.noDeployHead");
-      return t("perspectives.rerun.vsDeploy") + " " + shortSha(head.sha) + " · " + relTime(head.at);
+      if (rr.executionAssumedReached) why = rerunReasonText("perspectives.rerun.why.", rr.executionAssumedReached);
+      else if (!rr.touchedBy || !rr.touchedBy.length) why = t("perspectives.rerun.touchedUnknown");
+      else why = t("perspectives.rerun.touchedCount").replace("{n}", String(rr.touchedBy.length));
+    } else if (rr.verdict === "verified") {
+      why = !head
+        ? t("perspectives.rerun.noDeployHead")
+        : t("perspectives.rerun.vsDeploy") + " " + shortSha(head.sha) + " · " + relTime(head.at);
+    } else {
+      why = rerunWhyVerdict(rr);
     }
-    return rerunWhyVerdict(rr);
+    // A lapsed attestation is worth saying no matter which verdict the axes
+    // landed on afterwards — it is not that verdict's reason, so it is
+    // appended rather than replacing it.
+    var lapse = rerunManualLapseText(rr);
+    return lapse ? why + " · " + lapse : why;
   }
 
 
@@ -23218,10 +23771,10 @@ const CLIENT_JS = `
   // the pipeline still owes, then what needs nothing. "needsRepair" leads
   // because it is the only verdict a run cannot clear — someone has to repair
   // the spec or the product.
-  var RERUN_ORDER = ["needsRepair", "rerunNeeded", "inProgress", "verified"];
+  var RERUN_ORDER = ["needsRepair", "rerunNeeded", "inProgress", "manuallyVerified", "verified"];
   var RERUN_SEG_CLASS = {
     needsRepair: "sg-needsrepair", rerunNeeded: "sg-rerunneeded",
-    inProgress: "sg-inprogress", verified: "sg-verified"
+    inProgress: "sg-inprogress", manuallyVerified: "sg-manual", verified: "sg-verified"
   };
 
   // The one rule the summary bar and the verdict filter chips both answer
@@ -23235,7 +23788,7 @@ const CLIENT_JS = `
 
   // One verdict per case, bucketed, via rerunVerdictOf above.
   function rerunComposition(verdicts) {
-    var counts = { needsRepair: 0, rerunNeeded: 0, inProgress: 0, verified: 0 };
+    var counts = { needsRepair: 0, rerunNeeded: 0, inProgress: 0, manuallyVerified: 0, verified: 0 };
     verdicts.forEach(function (rr) { counts[rerunVerdictOf(rr)] += 1; });
     return counts;
   }
@@ -23403,7 +23956,7 @@ const CLIENT_JS = `
   // takes the attention colour and re-running — machine work — does not.
   var VERDICT_BADGE = {
     needsRepair: "rr-repair", rerunNeeded: "rr-needed",
-    inProgress: "rr-none", verified: "passed"
+    inProgress: "rr-none", manuallyVerified: "rr-manual", verified: "passed"
   };
 
   function perspVerdictCell(rr) {
@@ -23694,28 +24247,80 @@ const CLIENT_JS = `
   }
   // --- end pure: rerun detail labels ----------------------------------------
 
+  // --- pure: audit dismissal reading ----------------------------------------
+  // Self-contained (no DOM, no closures) for the same reason as the regions
+  // above: read rr.auditDismissed against rr.audit, per the schema's own
+  // comment on the field. "clean" means the dismissal is what is holding the
+  // axis there; "drifted"/"undecided" means a later audit re-raised what it
+  // answered, so the old dismissal no longer covers it.
+  // The audit has something outstanding on this spec. Both values mean the
+  // same thing to a reader deciding whether to answer it: the audit read the
+  // code and did not clear the spec (ADR-0019).
+  function auditOpen(rr) {
+    return !!rr && (rr.audit === "drifted" || rr.audit === "undecided");
+  }
+  function auditDismissalActive(rr) {
+    // The hub says whether the dismissal settled the axis. Inferring it from
+    // "clean" would credit the person for a later audit clearing the spec on
+    // its own, which reads identically here.
+    return !!(rr && rr.auditDismissed && rr.auditDismissalApplied);
+  }
+  function auditDismissalReflagged(rr) {
+    return !!(rr && rr.auditDismissed && auditOpen(rr));
+  }
+  // --- end pure: audit dismissal reading -------------------------------------
+
+  // The dismissal's own words, read against the current audit state: active,
+  // it explains why the axis reads clean; re-flagged, it is a fact worth
+  // keeping visible beside the finding that reopened it.
+  function rerunDismissalLine(rr) {
+    if (!rr || !rr.auditDismissed) return null;
+    var d = rr.auditDismissed;
+    if (auditDismissalActive(rr)) {
+      return {
+        muted: false,
+        text: t("perspectives.dismiss.activeNote")
+          .replace("{headline}", d.headline).replace("{by}", d.by).replace("{at}", relTime(d.at)).replace("{note}", d.note),
+      };
+    }
+    if (auditDismissalReflagged(rr)) {
+      return {
+        muted: true,
+        text: t("perspectives.dismiss.priorNote")
+          .replace("{by}", d.by).replace("{at}", relTime(d.at)).replace("{note}", d.note),
+      };
+    }
+    return null;
+  }
+
   // The evidence behind the verdict, as the value of whichever row
   // rerunEvidenceLabelKey chose. For needed/notNeeded that is what the deploy
   // log holds since this case last ran, named by rerunChangeLine.
   // The label already states the timeframe, so the value never repeats it.
+  // A dismissal (active or superseded by a later finding) is appended below
+  // whichever of those this case has, rather than replacing it — see
+  // rerunDismissalLine.
   function rerunEvidenceValue(rr) {
     var wrap = el("div");
     if (!rerunHasEvidence(rr)) {
       wrap.appendChild(el("div", "d-prose", rerunWhyVerdict(rr)));
-      return wrap;
-    }
-    // Both states require a non-empty deploy log, so a head-less report
-    // contradicts itself; rerunChangeLine then names what is missing rather
-    // than inventing a baseline.
-    var line = rerunChangeLine(rr, perspState.rerun && perspState.rerun.deployHead);
-    var text = t(line.key).replace("{sha}", shortSha(line.sha));
-    if (line.at) text += " · " + relTime(line.at);
-    wrap.appendChild(el("div", "d-prose", text));
-    // A touch the index proved but cannot enumerate leaves no paths to list;
-    // the line above still says a change landed, which is all that is known.
-    if (rr.verdict === "rerunNeeded" && rr.touchedBy && rr.touchedBy.length) {
-      wrap.appendChild(pathCodes(rr.touchedBy));
+    } else {
+      // Both states require a non-empty deploy log, so a head-less report
+      // contradicts itself; rerunChangeLine then names what is missing rather
+      // than inventing a baseline.
+      var line = rerunChangeLine(rr, perspState.rerun && perspState.rerun.deployHead);
+      var text = t(line.key).replace("{sha}", shortSha(line.sha));
+      if (line.at) text += " · " + relTime(line.at);
+      wrap.appendChild(el("div", "d-prose", text));
+      // A touch the index proved but cannot enumerate leaves no paths to
+      // list; the line above still says a change landed, which is all that
+      // is known.
+      if (rr.verdict === "rerunNeeded" && rr.touchedBy && rr.touchedBy.length) {
+        wrap.appendChild(pathCodes(rr.touchedBy));
+      }
     }
+    var dismissLine = rerunDismissalLine(rr);
+    if (dismissLine) wrap.appendChild(el("div", "d-prose" + (dismissLine.muted ? " muted" : ""), dismissLine.text));
     return wrap;
   }
 
@@ -23734,6 +24339,154 @@ const CLIENT_JS = `
     return wrap;
   }
 
+  // Lets a person's own check stand in for the machine's verdict. reloadRerun()
+  // is the same profile-scoped refresh a profile switch uses — it re-renders
+  // the whole table, so an open detail panel closes along with it.
+  function submitAttestation(method, body) {
+    apiFetch(attestationsPath(), {
+      method: method,
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+    }).then(function () { reloadRerun(); })
+      .catch(function (err) { window.alert(t("perspectives.manual.error") + ": " + err.message); });
+  }
+
+  // Lets a person say an audit finding was wrong. Same reload contract as
+  // submitAttestation above; a different endpoint (no ?profile=, ADR: a
+  // finding is about the repository).
+  function submitAuditDismissal(method, body) {
+    apiFetch(auditDismissalsPath(), {
+      method: method,
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+    }).then(function () { reloadRerun(); })
+      .catch(function (err) { window.alert(t("perspectives.manual.error") + ": " + err.message); });
+  }
+
+  function manualRevokeButton(feature, spec) {
+    var btn = el("button", "btn ghost sm del", t("perspectives.manual.revokeButton"));
+    btn.type = "button";
+    btn.addEventListener("click", function () {
+      if (!window.confirm(t("perspectives.manual.confirmRevoke"))) return;
+      submitAttestation("DELETE", { spec: perspSpecKey(feature, spec) });
+    });
+    return btn;
+  }
+
+  function auditDismissalRevokeButton(feature, spec) {
+    var btn = el("button", "btn ghost sm del", t("perspectives.dismiss.revokeButton"));
+    btn.type = "button";
+    btn.addEventListener("click", function () {
+      if (!window.confirm(t("perspectives.dismiss.confirmRevoke"))) return;
+      submitAuditDismissal("DELETE", { spec: perspSpecKey(feature, spec) });
+    });
+    return btn;
+  }
+
+  // The inline form a "dismiss" or "environment" offer button expands into,
+  // in place of the two window.prompt() calls this replaces. Both kinds ask
+  // for the same two things — who, and why — and differ only in wording and
+  // which endpoint the answer goes to.
+  function buildOverrideForm(kind, feature, spec, onCancel) {
+    var wrap = el("div", "override-form");
+
+    var byRow = el("div", "form-row");
+    byRow.appendChild(el("label", null, t("perspectives.override.byLabel")));
+    var byInput = el("input", "input");
+    byInput.type = "text";
+    byInput.value = loadAttestBy();
+    byRow.appendChild(byInput);
+    wrap.appendChild(byRow);
+
+    var noteRow = el("div", "form-row");
+    noteRow.appendChild(el("label", null, t(kind === "dismiss" ? "perspectives.override.reasonLabel" : "perspectives.override.noteLabel")));
+    var noteInput = el("textarea");
+    noteRow.appendChild(noteInput);
+    wrap.appendChild(noteRow);
+
+    var act = el("div", "of-act");
+    var submitBtn = el("button", "btn sm primary", t("perspectives.override.submit"));
+    submitBtn.type = "button";
+    submitBtn.disabled = true;
+    var cancelBtn = el("button", "btn ghost sm", t("perspectives.override.cancel"));
+    cancelBtn.type = "button";
+    act.appendChild(submitBtn);
+    act.appendChild(cancelBtn);
+    wrap.appendChild(act);
+
+    wrap.appendChild(el("div", "of-hint", t(kind === "dismiss" ? "perspectives.override.dismissHint" : "perspectives.override.envHint")));
+
+    function syncEnabled() {
+      submitBtn.disabled = !(byInput.value.trim() && noteInput.value.trim());
+    }
+    byInput.addEventListener("input", syncEnabled);
+    noteInput.addEventListener("input", syncEnabled);
+    cancelBtn.addEventListener("click", onCancel);
+
+    submitBtn.addEventListener("click", function () {
+      var by = byInput.value.trim();
+      var note = noteInput.value.trim();
+      if (!by || !note) return;
+      storeAttestBy(by);
+      if (kind === "dismiss") submitAuditDismissal("PUT", { spec: perspSpecKey(feature, spec), by: by, note: note });
+      else submitAttestation("PUT", { spec: perspSpecKey(feature, spec), by: by, note: note });
+    });
+
+    return wrap;
+  }
+
+  // A button that expands into buildOverrideForm above in place, rather than
+  // a modal — the action is rare enough that swapping the button for its own
+  // form reads fine without one.
+  function buildOverrideOffer(kind, feature, spec) {
+    var box = el("div", "manual-attest");
+    var openBtn = el("button", "btn sm primary", t(kind === "dismiss" ? "perspectives.dismiss.offerButton" : "perspectives.manual.envButton"));
+    openBtn.type = "button";
+    box.appendChild(openBtn);
+    openBtn.addEventListener("click", function () {
+      box.removeChild(openBtn);
+      var form = buildOverrideForm(kind, feature, spec, function () {
+        box.removeChild(form);
+        box.appendChild(openBtn);
+      });
+      box.appendChild(form);
+    });
+    return box;
+  }
+
+  // The audit-axis override slot: dismiss an open finding, or revoke a
+  // dismissal that is currently the reason the axis reads clean. At most one
+  // of the two ever shows — a finding the axis
+  // itself has cleared, dismissed or not, offers nothing here.
+  function auditOverrideBox(feature, spec, rr) {
+    if (auditDismissalActive(rr)) {
+      var box = el("div", "manual-attest");
+      box.appendChild(auditDismissalRevokeButton(feature, spec));
+      return box;
+    }
+    if (auditOpen(rr)) return buildOverrideOffer("dismiss", feature, spec);
+    return null;
+  }
+
+  // The execution-axis override slot: revoke a standing attestation, or offer
+  // one for an environment-caused failure — but only when the audit axis has
+  // no open finding of its own, which is auditOverrideBox's problem to answer,
+  // not this one's.
+  function executionOverrideBox(feature, spec, rr) {
+    if (rr.manual) {
+      var box = el("div", "manual-attest");
+      if (rr.verdict !== "manuallyVerified") box.appendChild(el("div", "d-prose", manualAttestationText(rr.manual)));
+      box.appendChild(manualRevokeButton(feature, spec));
+      return box;
+    }
+    // Only once the audit has actually cleared the spec: while it is still
+    // due, nobody knows yet whether the environment was the only thing wrong.
+    if (rr.audit === "clean" && rr.execution === "failed" && rr.lastRed && rr.lastRed.label === "ENVIRONMENT") {
+      return buildOverrideOffer("environment", feature, spec);
+    }
+    return null;
+  }
+
   // Detail row: a definition list of the case's fields plus the note editor.
   // Built with createElement/textContent throughout — every field here is
   // API-derived, so none of it may go through innerHTML.
@@ -23771,6 +24524,36 @@ const CLIENT_JS = `
     }
     frag.appendChild(dl);
 
+    if (spec.steps && spec.steps.length) {
+      var stepsBox = el("div", "steps-box");
+      stepsBox.appendChild(el("div", "slabel", t("perspectives.d.steps")));
+      var stepsList = el("ol", "d-steps");
+      spec.steps.forEach(function (step) {
+        var li = el("li");
+        if (step.include) {
+          li.textContent = t("perspectives.d.stepInclude").replace("{name}", step.include);
+        } else {
+          li.appendChild(document.createTextNode(step.instruction || ""));
+          if (step.expected) {
+            li.appendChild(el("div", "muted step-expected", t("perspectives.d.stepExpected") + " " + step.expected));
+          }
+        }
+        stepsList.appendChild(li);
+      });
+      stepsBox.appendChild(stepsList);
+      frag.appendChild(stepsBox);
+    }
+
+    // A person's override, always at most one control per axis: which finding
+    // is open decides whether that slot offers a new override or revokes a
+    // standing one (auditOverrideBox / executionOverrideBox).
+    if (rr) {
+      var auditBox = auditOverrideBox(feature, spec, rr);
+      if (auditBox) frag.appendChild(auditBox);
+      var execBox = executionOverrideBox(feature, spec, rr);
+      if (execBox) frag.appendChild(execBox);
+    }
+
     var notebox = el("div", "notebox");
     notebox.appendChild(el("div", "nlabel", t("perspectives.note.label")));
     var ta = el("textarea");
@@ -25062,6 +25845,12 @@ function registerRoutes(router, config, queue) {
 	router.get("/api/v1/projects/:project/audit-needed", createGetAuditNeedHandler(storage));
 	router.post("/api/v1/projects/:project/locks", createAcquireLocksHandler(storage));
 	router.delete("/api/v1/projects/:project/locks", createReleaseLocksHandler(storage));
+	router.get("/api/v1/projects/:project/attestations", createGetAttestationsHandler(storage));
+	router.put("/api/v1/projects/:project/attestations", createPutAttestationHandler(storage));
+	router.delete("/api/v1/projects/:project/attestations", createDeleteAttestationHandler(storage));
+	router.get("/api/v1/projects/:project/audit-dismissals", createGetAuditDismissalsHandler(storage));
+	router.put("/api/v1/projects/:project/audit-dismissals", createPutAuditDismissalHandler(storage));
+	router.delete("/api/v1/projects/:project/audit-dismissals", createDeleteAuditDismissalHandler(storage));
 	router.get("/api/v1/projects/:project/acks/:name", createGetAckHandler(storage));
 	router.put("/api/v1/projects/:project/acks/:name", createPutAckHandler(storage));
 	router.post("/api/v1/projects/:project/spend", createRecordSpendHandler(storage));
@@ -25351,6 +26140,12 @@ function deployTouchIndexPath(root, project, profile) {
 function specLocksPath(root, project, profile) {
 	return join(root, "locks", project, profile, "locks.json");
 }
+function attestationsPath(root, project, profile) {
+	return join(root, "attestations", project, profile, "attestations.json");
+}
+function auditDismissalsPath(root, project) {
+	return join(root, "audit-dismissals", `${project}.json`);
+}
 function ackPath(root, project, profile, name) {
 	return join(root, "acks", project, profile, `${name}.json`);
 }
@@ -25392,6 +26187,38 @@ function createFileAckStore(root) {
 	};
 }
 //#endregion
+//#region src/hub/core/storage/file/attestation-store.ts
+function toAttestations(doc) {
+	const parsed = AttestationsSchema.safeParse(doc);
+	return parsed.success ? parsed.data : { specs: {} };
+}
+function createFileAttestationStore(root) {
+	return {
+		async get(project, profile) {
+			return toAttestations(await readJson(attestationsPath(root, project, profile)));
+		},
+		async update(project, profile, mutate) {
+			return updateJson(attestationsPath(root, project, profile), (current) => mutate(toAttestations(current)));
+		}
+	};
+}
+//#endregion
+//#region src/hub/core/storage/file/audit-dismissal-store.ts
+function toDismissals(doc) {
+	const parsed = AuditDismissalsSchema.safeParse(doc);
+	return parsed.success ? parsed.data : { specs: {} };
+}
+function createFileAuditDismissalStore(root) {
+	return {
+		async get(project) {
+			return toDismissals(await readJson(auditDismissalsPath(root, project)));
+		},
+		async update(project, mutate) {
+			return updateJson(auditDismissalsPath(root, project), (current) => mutate(toDismissals(current)));
+		}
+	};
+}
+//#endregion
 //#region src/hub/core/storage/file/artifact-store.ts
 /**
 * Defense-in-depth: `relPath` is expected to already be validated by the
@@ -25875,7 +26702,9 @@ function createFileHubStorage(dataDir) {
 		deploys: createFileDeployStore(dataDir),
 		locks: createFileLockStore(dataDir),
 		acks: createFileAckStore(dataDir),
-		spend: createFileSpendStore(dataDir)
+		spend: createFileSpendStore(dataDir),
+		attestations: createFileAttestationStore(dataDir),
+		auditDismissals: createFileAuditDismissalStore(dataDir)
 	};
 }
 //#endregion