cool-workflow 0.1.98 → 0.2.1

package/dist/{orchestrator → shell}/report.js

@@ -1,218 +1,183 @@
 "use strict";
-// Report rendering for workflow runs — extracted from orchestrator.ts.
+// shell/report.ts — report.md generation (the byte-exact section
+// headers/fallback lines from the spec), the actual file write.
 //
-// Pure projection of a WorkflowRun into the human-readable run report and the
-// RunSummary view model. No orchestration state, no I/O beyond writing the
-// report file. The orchestrator re-imports the two public entry points
-// (writeReport, summarizeRun); every render*/format* helper here is private.
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
+// MILESTONE 6+7 (combined), EXTENDED at MILESTONE 11 (reporting/
+// observability) with the four sections that were deferred while their
+// own subsystems' milestones (8/9/4) had not yet landed: State Size &
+// Compaction (state-explosion, milestone 4), Sandbox Profiles (milestone
+// 5), Trust Audit (milestone 8), Acceptance Rationale (commit-gate,
+// milestone 6+7). Byte-exact port of
+// plugins/cool-workflow/src/orchestrator/report.ts's renderX helpers for
+// each.
+//
+// Evidence: SPEC/reporting-ux.md "report.md (written by writeReport)";
+// plugins/cool-workflow/src/orchestrator/report.ts:1-397 (byte-exact
+// source).
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.writeReport = writeReport;
-exports.summarizeRun = summarizeRun;
-const node_fs_1 = __importDefault(require("node:fs"));
-const dispatch_1 = require("../dispatch");
-const worker_isolation_1 = require("../worker-isolation");
-const candidate_scoring_1 = require("../candidate-scoring");
-const error_feedback_1 = require("../error-feedback");
-const multi_agent_1 = require("../multi-agent");
-const coordinator_1 = require("../coordinator");
-const trust_audit_1 = require("../trust-audit");
-const telemetry_ledger_1 = require("../telemetry-ledger");
-const state_explosion_1 = require("../state-explosion");
-function writeReport(run) {
-    (0, dispatch_1.updatePhaseStatuses)(run);
-    const workerSummary = (0, worker_isolation_1.summarizeWorkers)(run);
-    const candidateSummary = (0, candidate_scoring_1.summarizeCandidates)(run);
-    // A research run reads a local folder of files, not a code repo — label its source line
-    // "Source". Skip the relabel when the run ALSO carries a remote-provenance "- Source: <url>"
-    // line below (run.inputs.sourceUrl set by a --link/URL), so a report never shows two
-    // "- Source:" lines. Every other app keeps the byte-identical "Repository:" (POLA).
-    const sourceLabel = run.workflow.app?.metadata?.domain === "research" && !run.inputs.sourceUrl ? "Source" : "Repository";
-    const report = [
-        `# ${run.workflow.title}`,
-        "",
-        `- Run: ${run.id}`,
-        `- Workflow: ${run.workflow.id}`,
-        ...(run.workflow.app
-            ? [
-                `- Workflow App: ${run.workflow.app.id}@${run.workflow.app.version}`,
-                `- Workflow App Source: ${run.workflow.app.source?.manifestPath || run.workflow.app.source?.entrypointPath || run.workflow.app.source?.path || ""}`
-            ]
-            : []),
-        `- Created: ${run.createdAt}`,
-        `- Updated: ${run.updatedAt}`,
-        `- ${sourceLabel}: ${String(run.inputs.repo || run.cwd)}`,
-        // Remote provenance (v0.1.91): when the repo was materialized from a --link/URL, record
-        // the sanitized origin + resolved commit so the report itself says where the code came
-        // from. Conditional — absent for a local-repo run, so existing reports stay byte-identical.
-        ...(run.inputs.sourceUrl
-            ? [`- Source: ${String(run.inputs.sourceUrl)}${run.inputs.sourceCommit ? `@${String(run.inputs.sourceCommit)}` : ""}`]
-            : []),
-        `- Question: ${String(run.inputs.question || "")}`,
-        `- Invariants: ${formatInputList(run.inputs.invariant)}`,
-        `- Loop Stage: ${run.loopStage}`,
-        "",
-        "## Phase Status",
-        "",
-        "| Phase | Status | Completed | Total |",
-        "| --- | --- | ---: | ---: |",
-        ...run.phases.map((phase) => {
-            const phaseTasks = run.tasks.filter((task) => phase.taskIds.includes(task.id));
-            const completed = phaseTasks.filter((task) => task.status === "completed").length;
-            return `| ${phase.name} | ${phase.status} | ${completed} | ${phaseTasks.length} |`;
-        }),
-        "",
-        "## State Commits",
-        "",
-        ...renderCommits(run),
-        "",
-        "## Error Feedback",
-        "",
-        ...renderFeedback(run),
-        "",
-        "## Workers",
-        "",
-        ...renderWorkers(workerSummary),
-        "",
-        "## State Size & Compaction",
-        "",
-        ...renderStateSize(run),
-        "",
-        "## Multi-Agent Runtime",
-        "",
-        ...renderMultiAgent(run),
-        "",
-        "## Blackboard / Coordinator",
-        "",
-        ...renderBlackboard(run),
-        "",
-        "## Sandbox Profiles",
-        "",
-        ...renderSandboxProfiles(run),
-        "",
-        "## Trust Audit",
-        "",
-        ...renderTrustAudit(run),
-        "",
-        "## Acceptance Rationale",
-        "",
-        ...renderAcceptanceRationale(run),
-        "",
-        "## Candidates",
-        "",
-        ...renderCandidates(candidateSummary),
-        "",
-        "## Pending Tasks",
-        "",
-        ...renderPendingTasks(run),
-        "",
-        "## Results",
-        "",
-        ...renderResults(run)
-    ].join("\n");
-    node_fs_1.default.writeFileSync(run.paths.report, report, "utf8");
-    return run.paths.report;
-}
-function summarizeRun(run) {
-    (0, dispatch_1.updatePhaseStatuses)(run);
-    const workerSummary = (0, worker_isolation_1.summarizeWorkers)(run);
-    const createdAtMs = Date.parse(run.createdAt);
-    const updatedAtMs = Date.parse(run.updatedAt);
-    const durationMs = Number.isFinite(createdAtMs) && Number.isFinite(updatedAtMs) ? Math.max(0, updatedAtMs - createdAtMs) : undefined;
-    return {
-        runId: run.id,
-        workflowId: run.workflow.id,
-        app: run.workflow.app,
-        phases: run.phases,
-        tasks: {
-            total: run.tasks.length,
-            pending: run.tasks.filter((task) => task.status === "pending").length,
-            running: run.tasks.filter((task) => task.status === "running").length,
-            failed: run.tasks.filter((task) => task.status === "failed").length,
-            completed: run.tasks.filter((task) => task.status === "completed").length
-        },
-        loopStage: run.loopStage,
-        durationMs,
-        progressPercent: run.tasks.length ? Math.round((run.tasks.filter((t) => t.status === "completed").length / run.tasks.length) * 100) : 0,
-        next: (0, dispatch_1.firstRunnablePhase)(run)?.name || null,
-        reportPath: run.paths.report,
-        commits: run.commits,
-        workers: {
-            total: workerSummary.total,
-            byStatus: workerSummary.byStatus
-        }
-    };
+const fs = __importStar(require("node:fs"));
+const dispatch_1 = require("../core/pipeline/dispatch");
+const state_explosion_cli_1 = require("./state-explosion-cli");
+const state_explosion_text_1 = require("../core/format/state-explosion-text");
+const candidate_scoring_io_1 = require("./candidate-scoring-io");
+const trust_audit_1 = require("./trust-audit");
+const telemetry_ledger_io_1 = require("./telemetry-ledger-io");
+const multi_agent_io_1 = require("./multi-agent-io");
+const coordinator_io_1 = require("./coordinator-io");
+const multi_agent_operator_ux_1 = require("./multi-agent-operator-ux");
+function formatInputList(value) {
+    if (Array.isArray(value))
+        return value.join("; ");
+    return value ? String(value) : "";
 }
-function renderPendingTasks(run) {
-    const pending = run.tasks.filter((task) => task.status === "pending" || task.status === "running");
-    if (!pending.length)
-        return ["No pending tasks."];
-    return pending.map((task) => `- ${task.id} (${task.phase}, ${task.status}): ${task.taskPath}`);
+function formatCounts(counts) {
+    const entries = Object.entries(counts).sort(([a], [b]) => a.localeCompare(b));
+    if (!entries.length)
+        return "none";
+    return entries.map(([k, v]) => `${k}=${v}`).join(", ");
 }
-function renderResults(run) {
-    const completed = run.tasks.filter((task) => task.status === "completed");
-    if (!completed.length)
-        return ["No completed results yet."];
-    const lines = [];
-    for (const task of completed) {
-        lines.push(`### ${task.id}`, "", `Result: ${task.resultPath}`, "");
-        if (task.resultPath && node_fs_1.default.existsSync(task.resultPath)) {
-            lines.push(node_fs_1.default.readFileSync(task.resultPath, "utf8").trim(), "");
-        }
-        else {
-            lines.push("_Result file is not present on this host; state metadata remains inspectable._", "");
-        }
+function countBy(values, key) {
+    const counts = {};
+    for (const value of values) {
+        const bucket = key(value);
+        counts[bucket] = (counts[bucket] || 0) + 1;
     }
-    return lines;
+    return counts;
 }
 function renderCommits(run) {
     if (!run.commits.length)
         return ["No state commits yet."];
     return run.commits.map((commit) => {
         const kind = commit.verifierGated ? "verifier-gated commit" : "checkpoint";
-        const gate = commit.verifierGated ? formatCommitGate(commit) : "verifierGated=false";
+        const gate = commit.verifierGated ? `verifier=${commit.verifierNodeId || "unknown"}, evidence=${commit.evidence?.length || 0}` : "verifierGated=false";
         return `- ${commit.id}: ${commit.reason} [${commit.loopStage}; ${kind}; ${gate}] (${commit.snapshotPath})`;
     });
 }
-function renderFeedback(run) {
-    const summary = (0, error_feedback_1.summarizeFeedback)(run);
-    if (!summary.total)
-        return ["No feedback records."];
+/** `## State Size & Compaction` — milestone 4's state-explosion report,
+ *  rendered with its own dedicated text formatter (always non-empty; no
+ *  "no records" fallback in the old build either). */
+function renderStateSize(run) {
+    const index = (0, state_explosion_cli_1.loadStateExplosionSummaryIndex)(run);
+    const report = (0, state_explosion_cli_1.buildStateExplosionReport)(run, { index, operator: (0, multi_agent_operator_ux_1.operatorDigestInput)(run) });
+    return (0, state_explosion_text_1.stateExplosionReportLines)(report);
+}
+/** `## Sandbox Profiles` — byte-exact port of the old build's
+ *  renderSandboxProfiles (src/orchestrator/report.ts:277-287). */
+function renderSandboxProfiles(run) {
+    const profiles = run.sandboxProfiles || [];
+    if (!profiles.length)
+        return ["No sandbox profiles selected yet."];
+    return profiles.map((profile) => [
+        `- ${profile.id}: read=${profile.readPaths.length}, write=${profile.writePaths.length}, execute=${profile.execute.mode}, network=${profile.network.mode}`,
+        `  enforcedByCW=${profile.enforcement.enforcedByCW.join("; ")}`,
+        `  hostRequired=${profile.enforcement.hostRequired.join("; ")}`,
+    ].join("\n"));
+}
+/** `## Trust Audit` — byte-exact port of the old build's renderTrustAudit
+ *  + renderTelemetryAttestation (src/orchestrator/report.ts:301-355). */
+function renderTrustAudit(run) {
+    const summary = (0, trust_audit_1.summarizeTrustAudit)(run);
+    const integrity = summary.integrity;
     return [
-        `- Total: ${summary.total}`,
-        `- By status: ${formatCounts(summary.byStatus)}`,
-        `- By severity: ${formatCounts(summary.bySeverity)}`,
-        `- By classification: ${formatCounts(summary.byClassification)}`,
-        "",
-        ...summary.artifacts.map((artifact) => `- ${artifact}`)
+        `- Events: ${summary.eventCount}`,
+        `- Chain integrity: ${integrity ? (integrity.verified ? "verified" : "FAILED") : "n/a"}` +
+            `${integrity ? ` (${integrity.chained} chained, ${integrity.unchained} legacy${integrity.corruptLines ? `, ${integrity.corruptLines} corrupt` : ""})` : ""}`,
+        ...(integrity && !integrity.verified
+            ? [`  !! TRUST-AUDIT CHAIN TAMPER DETECTED: ${integrity.checks.filter((c) => !c.pass).map((c) => c.code).join(", ")}`]
+            : []),
+        `- Decisions: ${formatCounts(summary.byDecision)}`,
+        `- Sources: ${formatCounts(summary.bySource)}`,
+        `- Sandbox profiles: ${formatCounts(summary.bySandboxProfile)}`,
+        `- Event log: ${summary.eventLogPath}`,
+        `- Summary: ${summary.summaryPath}`,
+        `- Index: ${summary.indexPath}`,
+        ...renderTelemetryAttestation(run),
     ];
 }
-function renderWorkers(summary) {
-    if (!summary.total)
-        return ["No worker scopes yet."];
+/** Telemetry attestation coverage + a LOUD list of any `unattested`
+ *  usage, byte-exact port of the old build's renderTelemetryAttestation. */
+function renderTelemetryAttestation(run) {
+    const delegations = (0, trust_audit_1.listTrustAuditEvents)(run).filter((event) => event.kind === "worker.agent-delegation" && event.metadata && event.metadata.telemetryAttestation);
+    if (!delegations.length)
+        return [];
+    const statusOf = (event) => String(event.metadata.telemetryAttestation);
+    const attested = delegations.filter((event) => statusOf(event) === "attested").length;
+    const unattested = delegations.filter((event) => statusOf(event) === "unattested");
+    const absent = delegations.filter((event) => statusOf(event) === "absent").length;
     const lines = [
-        `- Total: ${summary.total}`,
-        `- By status: ${formatCounts(summary.byStatus)}`,
-        "",
-        ...summary.manifestPaths.map((artifact) => `- ${artifact}`)
+        `- Telemetry attestation: ${attested}/${delegations.length} attested` +
+            (unattested.length ? `, ${unattested.length} UNATTESTED` : "") +
+            (absent ? `, ${absent} absent` : ""),
     ];
-    if (summary.failed.length) {
-        lines.push("", "Failed or rejected:");
-        for (const worker of summary.failed) {
-            lines.push(`- ${worker.id} (${worker.status}) feedback=${worker.feedbackIds.join(",") || "none"}`);
-        }
+    for (const event of unattested) {
+        const reason = event.metadata.telemetryAttestationReason;
+        lines.push(`  - ⚠️  UNATTESTED usage — worker=${event.workerId || "?"} task=${event.taskId || "?"}: ${reason || "signature unverified"}`);
+    }
+    const ledger = (0, telemetry_ledger_io_1.verifyTelemetryLedger)(run);
+    if (ledger.present) {
+        lines.push(ledger.verified
+            ? `- Attestation ledger: ${ledger.records.length} records, chain verified (tamper-evident)`
+            : `  - ⚠️  ATTESTATION LEDGER CHAIN BROKEN — a recorded verdict/usage was edited after the fact (${ledger.checks.filter((c) => !c.pass).map((c) => c.name).join(", ")})`);
     }
     return lines;
 }
-function renderStateSize(run) {
-    const index = (0, state_explosion_1.loadStateExplosionSummaryIndex)(run);
-    const report = (0, state_explosion_1.buildStateExplosionReport)(run, { index });
-    return (0, state_explosion_1.stateExplosionReportLines)(report);
+/** `## Acceptance Rationale` — byte-exact port of the old build's
+ *  renderAcceptanceRationale (src/orchestrator/report.ts:357-374). */
+function renderAcceptanceRationale(run) {
+    const lines = [];
+    for (const selectionRaw of run.candidateSelections || []) {
+        const selection = selectionRaw;
+        const rationale = selection.acceptanceRationale;
+        if (!rationale)
+            continue;
+        lines.push(`- Selection ${selection.id}: candidate=${rationale.selectedCandidateId || selection.candidateId}, score=${rationale.scoreId || "none"}, verifier=${rationale.verifierNodeId || "none"}, evidence=${rationale.evidenceCount}, sandbox=${rationale.sandboxProfileId || "none"}, worker=${rationale.workerId || "none"}`);
+    }
+    for (const commit of run.commits || []) {
+        if (!commit.acceptanceRationale)
+            continue;
+        const rationale = commit.acceptanceRationale;
+        lines.push(`- Commit ${commit.id}: gate=${rationale.commitGateResult || "unknown"}, candidate=${rationale.selectedCandidateId || commit.candidateId || "none"}, score=${rationale.scoreId || "none"}, verifier=${rationale.verifierNodeId || commit.verifierNodeId || "none"}, evidence=${rationale.evidenceCount}, sandbox=${rationale.sandboxProfileId || "none"}, worker=${rationale.workerId || "none"}`);
+    }
+    return lines.length ? lines : ["No accepted candidate or verifier-gated commit rationale yet."];
 }
+/** `## Multi-Agent Runtime` — byte-exact port of the old build's
+ *  renderMultiAgent (src/orchestrator/report.ts:217-242). */
 function renderMultiAgent(run) {
-    const summary = (0, multi_agent_1.summarizeMultiAgent)(run);
+    const summary = (0, multi_agent_io_1.summarizeMultiAgent)(run);
     if (!summary.totalRuns)
         return ["No multi-agent runtime records yet."];
     const lines = [
@@ -221,7 +186,7 @@ function renderMultiAgent(run) {
         `- Groups: ${summary.groups} (${formatCounts(summary.groupsByStatus)})`,
         `- Memberships: ${summary.memberships} (${formatCounts(summary.membershipsByStatus)})`,
         `- Fanouts: ${summary.fanouts}`,
-        `- Fanins: ${summary.fanins} (${formatCounts(summary.faninsByStatus)})`
+        `- Fanins: ${summary.fanins} (${formatCounts(summary.faninsByStatus)})`,
     ];
     if (summary.blockedReasons.length) {
         lines.push("", "Blocked:");
@@ -240,8 +205,10 @@ function renderMultiAgent(run) {
         lines.push("", `Next multi-agent action: ${summary.nextAction}`);
     return lines;
 }
+/** `## Blackboard / Coordinator` — byte-exact port of the old build's
+ *  renderBlackboard (src/orchestrator/report.ts:244-275). */
 function renderBlackboard(run) {
-    const summary = (0, coordinator_1.summarizeBlackboard)(run);
+    const summary = (0, coordinator_io_1.summarizeBlackboard)(run);
     if (!summary.blackboardId)
         return ["No blackboard records yet."];
     const lines = [
@@ -254,7 +221,7 @@ function renderBlackboard(run) {
         `- Decisions: ${summary.decisions}`,
         `- Ready for fanin: ${summary.readyForFanin ? "yes" : "no"}`,
         `- Index: ${summary.indexPath || "none"}`,
-        `- Latest snapshot: ${summary.latestSnapshotPath || "none"}`
+        `- Latest snapshot: ${summary.latestSnapshotPath || "none"}`,
     ];
     if (summary.openQuestions.length) {
         lines.push("", "Open questions:");
@@ -276,17 +243,10 @@ function renderBlackboard(run) {
         lines.push("", `Next coordinator action: ${summary.nextAction}`);
     return lines;
 }
-function renderSandboxProfiles(run) {
-    const profiles = run.sandboxProfiles || [];
-    if (!profiles.length)
-        return ["No sandbox profiles selected yet."];
-    return profiles.map((profile) => [
-        `- ${profile.id}: read=${profile.readPaths.length}, write=${profile.writePaths.length}, execute=${profile.execute.mode}, network=${profile.network.mode}`,
-        `  enforcedByCW=${profile.enforcement.enforcedByCW.join("; ")}`,
-        `  hostRequired=${profile.enforcement.hostRequired.join("; ")}`
-    ].join("\n"));
-}
-function renderCandidates(summary) {
+/** `## Candidates` — byte-exact port of the old build's renderCandidates
+ *  (src/orchestrator/report.ts:289-299). */
+function renderCandidatesSection(run) {
+    const summary = (0, candidate_scoring_io_1.summarizeCandidates)(run);
     if (!summary.total)
         return ["No candidates yet."];
     return [
@@ -295,94 +255,141 @@ function renderCandidates(summary) {
         `- By kind: ${formatCounts(summary.byKind)}`,
         `- Selections: ${summary.selections}`,
         `- Index: ${summary.indexPath}`,
-        `- Ranking: ${summary.rankingPath}`
+        `- Ranking: ${summary.rankingPath}`,
     ];
 }
-function renderTrustAudit(run) {
-    const summary = (0, trust_audit_1.summarizeTrustAudit)(run);
-    const integrity = summary.integrity;
+function renderFeedback(run) {
+    const records = (run.feedback || []);
+    if (!records.length)
+        return ["No feedback records."];
     return [
-        `- Events: ${summary.eventCount}`,
-        `- Chain integrity: ${integrity ? (integrity.verified ? "verified" : "FAILED") : "n/a"}` +
-            `${integrity ? ` (${integrity.chained} chained, ${integrity.unchained} legacy${integrity.corruptLines ? `, ${integrity.corruptLines} corrupt` : ""})` : ""}`,
-        // An auditable control-plane never lets a broken decision-log chain pass
-        // silently — name the failing checks loudly, same as the telemetry chain.
-        ...(integrity && !integrity.verified
-            ? [`  !! TRUST-AUDIT CHAIN TAMPER DETECTED: ${integrity.checks.filter((c) => !c.pass).map((c) => c.code).join(", ")}`]
-            : []),
-        `- Decisions: ${formatCounts(summary.byDecision)}`,
-        `- Sources: ${formatCounts(summary.bySource)}`,
-        `- Sandbox profiles: ${formatCounts(summary.bySandboxProfile)}`,
-        `- Event log: ${summary.eventLogPath}`,
-        `- Summary: ${summary.summaryPath}`,
-        `- Index: ${summary.indexPath}`,
-        ...renderTelemetryAttestation(run)
+        `- Total: ${records.length}`,
+        `- By status: ${formatCounts(countBy(records, (r) => r.status))}`,
+        `- By severity: ${formatCounts(countBy(records, (r) => r.severity))}`,
+        `- By classification: ${formatCounts(countBy(records, (r) => r.classification))}`,
     ];
 }
-/** Track 1: telemetry attestation coverage + a LOUD list of any `unattested`
- *  usage. An auditable control-plane never lets unverified telemetry pass
- *  silently — every reported-but-unverified usage is named here with its reason. */
-function renderTelemetryAttestation(run) {
-    const delegations = (0, trust_audit_1.listTrustAuditEvents)(run).filter((event) => event.kind === "worker.agent-delegation" && event.metadata && event.metadata.telemetryAttestation);
-    if (!delegations.length)
-        return [];
-    const statusOf = (event) => String(event.metadata.telemetryAttestation);
-    const attested = delegations.filter((event) => statusOf(event) === "attested").length;
-    const unattested = delegations.filter((event) => statusOf(event) === "unattested");
-    const absent = delegations.filter((event) => statusOf(event) === "absent").length;
-    const lines = [
-        `- Telemetry attestation: ${attested}/${delegations.length} attested` +
-            (unattested.length ? `, ${unattested.length} UNATTESTED` : "") +
-            (absent ? `, ${absent} absent` : "")
-    ];
-    for (const event of unattested) {
-        const reason = event.metadata.telemetryAttestationReason;
-        lines.push(`  - ⚠️  UNATTESTED usage — worker=${event.workerId || "?"} task=${event.taskId || "?"}: ${reason || "signature unverified"}`);
-    }
-    // Tamper-evidence: re-prove the hash-chained ledger. A broken chain means a
-    // recorded verdict/usage was edited after the fact — surfaced LOUDLY.
-    const ledger = (0, telemetry_ledger_1.verifyTelemetryLedger)(run);
-    if (ledger.present) {
-        lines.push(ledger.verified
-            ? `- Attestation ledger: ${ledger.records.length} records, chain verified (tamper-evident)`
-            : `  - ⚠️  ATTESTATION LEDGER CHAIN BROKEN — a recorded verdict/usage was edited after the fact (${ledger.checks.filter((c) => !c.pass).map((c) => c.name).join(", ")})`);
+function renderWorkers(run) {
+    const workers = run.workers || [];
+    if (!workers.length)
+        return ["No worker scopes yet."];
+    const lines = [`- Total: ${workers.length}`, `- By status: ${formatCounts(countBy(workers, (w) => w.status))}`];
+    const failed = workers.filter((w) => w.status === "failed" || w.status === "rejected");
+    if (failed.length) {
+        lines.push("", "Failed or rejected:");
+        for (const w of failed)
+            lines.push(`- ${w.id} (${w.status}) feedback=${w.feedbackIds.join(",") || "none"}`);
     }
     return lines;
 }
-function renderAcceptanceRationale(run) {
+function renderPendingTasks(run) {
+    const pending = run.tasks.filter((t) => t.status === "pending" || t.status === "running");
+    if (!pending.length)
+        return ["No pending tasks."];
+    return pending.map((t) => `- ${t.id} (${t.phase}, ${t.status}): ${t.taskPath}`);
+}
+function renderResults(run) {
+    const completed = run.tasks.filter((t) => t.status === "completed");
+    if (!completed.length)
+        return ["No completed results yet."];
     const lines = [];
-    for (const selection of run.candidateSelections || []) {
-        const rationale = selection.acceptanceRationale;
-        if (!rationale)
-            continue;
-        lines.push(`- Selection ${selection.id}: candidate=${rationale.selectedCandidateId || selection.candidateId}, score=${rationale.scoreId || "none"}, verifier=${rationale.verifierNodeId || "none"}, evidence=${rationale.evidenceCount}, sandbox=${rationale.sandboxProfileId || "none"}, worker=${rationale.workerId || "none"}`);
-    }
-    for (const commit of run.commits || []) {
-        if (!commit.acceptanceRationale)
-            continue;
-        const rationale = commit.acceptanceRationale;
-        lines.push(`- Commit ${commit.id}: gate=${rationale.commitGateResult || "unknown"}, candidate=${rationale.selectedCandidateId || commit.candidateId || "none"}, score=${rationale.scoreId || "none"}, verifier=${rationale.verifierNodeId || commit.verifierNodeId || "none"}, evidence=${rationale.evidenceCount}, sandbox=${rationale.sandboxProfileId || "none"}, worker=${rationale.workerId || "none"}`);
+    for (const task of completed) {
+        lines.push(`### ${task.id}`, "", `Result: ${task.resultPath}`, "");
+        if (task.resultPath && fs.existsSync(task.resultPath)) {
+            lines.push(fs.readFileSync(task.resultPath, "utf8").trim(), "");
+        }
+        else {
+            lines.push("_Result file is not present on this host; state metadata remains inspectable._", "");
+        }
     }
-    return lines.length ? lines : ["No accepted candidate or verifier-gated commit rationale yet."];
-}
-function formatCommitGate(commit) {
-    return [
-        `verifier=${commit.verifierNodeId || "unknown"}`,
-        commit.candidateId ? `candidate=${commit.candidateId}` : "",
-        commit.selectionId ? `selection=${commit.selectionId}` : "",
-        `evidence=${commit.evidence?.length || 0}`
-    ]
-        .filter(Boolean)
-        .join(", ");
-}
-function formatCounts(counts) {
-    const entries = Object.entries(counts).sort(([left], [right]) => left.localeCompare(right));
-    if (!entries.length)
-        return "none";
-    return entries.map(([key, value]) => `${key}=${value}`).join(", ");
+    return lines;
 }
-function formatInputList(value) {
-    if (Array.isArray(value))
-        return value.join("; ");
-    return value ? String(value) : "";
+/** writeReport — renders report.md and writes it. Returns the path. */
+function writeReport(run) {
+    (0, dispatch_1.updatePhaseStatuses)(run);
+    const workflowApp = run.workflow.app;
+    // A research run reads a local folder of files, not a code repo — label
+    // its source line "Source". Skip the relabel when the run ALSO carries a
+    // remote-provenance "- Source: <url>" line below (run.inputs.sourceUrl
+    // set by a --link/URL), so a report never shows two "- Source:" lines.
+    // Every other app keeps the byte-identical "Repository:" (POLA).
+    const sourceLabel = workflowApp?.metadata?.domain === "research" && !run.inputs.sourceUrl ? "Source" : "Repository";
+    const report = [
+        `# ${run.workflow.title}`,
+        "",
+        `- Run: ${run.id}`,
+        `- Workflow: ${run.workflow.id}`,
+        ...(workflowApp
+            ? [`- Workflow App: ${workflowApp.id}@${workflowApp.version}`, `- Workflow App Source: ${workflowApp.source?.manifestPath || workflowApp.source?.entrypointPath || workflowApp.source?.path || ""}`]
+            : []),
+        `- Created: ${run.createdAt}`,
+        `- Updated: ${run.updatedAt}`,
+        `- ${sourceLabel}: ${String(run.inputs.repo || run.cwd)}`,
+        ...(run.inputs.sourceUrl
+            ? [`- Source: ${String(run.inputs.sourceUrl)}${run.inputs.sourceCommit ? `@${String(run.inputs.sourceCommit)}` : ""}`]
+            : []),
+        `- Question: ${String(run.inputs.question || "")}`,
+        `- Invariants: ${formatInputList(run.inputs.invariant)}`,
+        `- Loop Stage: ${run.loopStage}`,
+        "",
+        "## Phase Status",
+        "",
+        "| Phase | Status | Completed | Total |",
+        "| --- | --- | ---: | ---: |",
+        ...run.phases.map((phase) => {
+            const phaseTasks = run.tasks.filter((t) => phase.taskIds.includes(t.id));
+            const completed = phaseTasks.filter((t) => t.status === "completed").length;
+            return `| ${phase.name} | ${phase.status} | ${completed} | ${phaseTasks.length} |`;
+        }),
+        "",
+        "## State Commits",
+        "",
+        ...renderCommits(run),
+        "",
+        "## Error Feedback",
+        "",
+        ...renderFeedback(run),
+        "",
+        "## Workers",
+        "",
+        ...renderWorkers(run),
+        "",
+        "## State Size & Compaction",
+        "",
+        ...renderStateSize(run),
+        "",
+        "## Multi-Agent Runtime",
+        "",
+        ...renderMultiAgent(run),
+        "",
+        "## Blackboard / Coordinator",
+        "",
+        ...renderBlackboard(run),
+        "",
+        "## Sandbox Profiles",
+        "",
+        ...renderSandboxProfiles(run),
+        "",
+        "## Trust Audit",
+        "",
+        ...renderTrustAudit(run),
+        "",
+        "## Acceptance Rationale",
+        "",
+        ...renderAcceptanceRationale(run),
+        "",
+        "## Candidates",
+        "",
+        ...renderCandidatesSection(run),
+        "",
+        "## Pending Tasks",
+        "",
+        ...renderPendingTasks(run),
+        "",
+        "## Results",
+        "",
+        ...renderResults(run),
+    ].join("\n");
+    fs.writeFileSync(run.paths.report, report, "utf8");
+    return run.paths.report;
 }