great-cto 3.69.0 → 3.70.0

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 72 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.69.0",
+  "version": "3.70.0",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"

package/board/packages/board/lib/routes.mjs

@@ -1266,6 +1266,11 @@ async function dispatch(req, res, url, cwd) {
   // shared sanitized projection only: prompts, approval tokens and artifact
   // bytes never cross into the browser payload.
   if (pathname === '/api/codex-runs') {
+    if (requestedProject && resolveProjectInfo(requestedProject).resolved === 'fallback') {
+      res.writeHead(404, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ error: 'Unknown project; execution graphs were not read', state: 'unavailable' }));
+      return true;
+    }
     const result = listCodexRuns({ root: cwd });
     const headers = { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' };
     if (result.state === 'degraded') headers['X-Board-Degraded'] = encodeURIComponent(`${result.unreadable} unreadable Codex run state file(s)`);

package/board/packages/board/lib/work.mjs

@@ -29,7 +29,8 @@ function executionAttempts(run) {
     phase: short(a.phase), status: short(a.status), startedAt: date(a.startedAt), finishedAt: date(a.finishedAt),
   }));
   const truncated = attempts.length > 200;
-  return { state: nodes.length ? 'recorded' : 'unknown', nodes, topology: 'unknown', truncated,
+  const graph = run?.executionGraph || { state: 'unavailable', complete: false, nodes: [], edges: [], snapshots: [], reason: 'No linked controller-recorded graph is available.' };
+  return { state: nodes.length ? 'recorded' : 'unknown', nodes, topology: graph.state === 'recorded' ? 'recorded' : 'unknown', graph, truncated,
     partial: !run || truncated || nodes.length !== window.length,
     reason: !run ? 'Stable attempt observations are unavailable without a single explicitly linked controlled run.'
       : !nodes.length ? 'No usable attempt observations are recorded.' : null };

package/board/packages/board/public/assets/admin-shell.css

@@ -1,4 +1,18 @@
 /* Approved task-first shell, using existing light/dark semantic tokens. */
+.execution-graph{min-width:0;margin:18px 0;padding:16px;border:1px solid var(--border-strong);border-radius:6px;background:var(--bg-card)}
+.execution-graph-tools{display:flex;gap:8px;flex-wrap:wrap;margin:12px 0}
+.execution-graph-canvas{overflow:auto;max-width:100%;max-height:560px;border:1px solid var(--border-strong);background:var(--bg-page)}
+.execution-graph-canvas svg{display:block;max-width:none;font-family:var(--sans);font-size:12px;color:var(--text)}
+.execution-node{cursor:pointer;outline:none}
+.execution-node rect{fill:var(--bg-card);stroke:var(--text2);stroke-width:1.5}
+.execution-node text{fill:var(--text)}
+.execution-node:focus rect,.execution-node:hover rect{stroke:var(--focus-ring);stroke-width:3}
+.execution-edges{stroke:var(--text2);stroke-width:1.5}
+#execution-arrow path{fill:var(--text2)}
+.execution-node-detail{margin:8px 0;padding:10px;border:1px solid var(--border-strong);border-radius:5px;overflow-wrap:anywhere}
+.execution-node-detail summary{cursor:pointer;min-height:28px}
+.execution-node-detail dt{margin-top:10px;font-weight:600}
+.execution-node-detail dd{margin:4px 0;color:var(--text2);overflow-wrap:anywhere}
 #nav-tablist .nav-item{width:100%;background:transparent;border:0;border-radius:5px;font-family:var(--sans,Geist,sans-serif);font-size:14px;text-align:left;min-height:44px;color:var(--text2);cursor:pointer}
 #nav-tablist .nav-item.active{background:var(--accent-soft);color:var(--text);font-weight:600}
 #nav-tablist .nav-item:hover{background:var(--bg-muted)}

package/board/packages/board/public/assets/work-view.js

@@ -73,7 +73,8 @@
     const roles = Array.isArray(entry.evidence) ? entry.evidence : [];
     const execution = entry.execution, nodes = Array.isArray(execution?.nodes) ? execution.nodes.slice(0, 200) : [];
     return '<section class="work-execution"><h3>Recorded observations</h3>'
-      + '<p>Dependencies not recorded. This is an observation list, not an inferred execution graph. Event order does not establish dependencies.</p>'
+      + renderExecutionGraph(execution?.graph)
+      + (execution?.graph?.state === 'recorded' ? '' : '<p>Dependencies not recorded. This is an observation list, not an inferred execution graph. Event order does not establish dependencies.</p>')
       + `<p>Recorded stage: ${esc(entry.stage || 'not recorded')}</p>`
       + (execution?.reason ? `<p>${esc(execution.reason)}</p>` : '')
       + (execution?.truncated ? '<p class="work-warning">Showing the latest 200 recorded attempts; earlier observations are truncated.</p>' : execution?.partial ? '<p class="work-warning">Attempt observations are incomplete.</p>' : '')
@@ -84,6 +85,60 @@
       + (entry.inspector ? renderInspector(entry.inspector).replace('<details ', '<details open ') : '<p>Linked activity unavailable. Absence of events is not proof of inactivity.</p>')
       + '</section>';
   }
+  function renderExecutionGraph(graph) {
+    if (graph?.state !== 'recorded' || !Array.isArray(graph.nodes) || !graph.nodes.length)
+      return `<p class="work-meta">${esc(graph?.reason || 'Controller-recorded graph unavailable. Native and legacy observations remain partial.')}</p>`;
+    if (graph.nodes.length > 512 || !Array.isArray(graph.edges) || graph.edges.length > 2048) return '<p>Graph exceeds the display limit.</p>';
+    const nodes = graph.nodes, ids = new Map(nodes.map((n, i) => [n.id, i]));
+    if (ids.size !== nodes.length || graph.edges.some(e => !ids.has(e.from) || !ids.has(e.to) || ids.get(e.from) >= ids.get(e.to)))
+      return '<p>Graph dependencies cannot be displayed safely.</p>';
+    const levels = new Map(nodes.map(n => [n.id, 0]));
+    const parents = new Map(nodes.map(n => [n.id, []]));
+    for (const e of graph.edges) parents.get(e.to).push(e);
+    const rows = new Map(), positions = new Map();
+    for (const n of nodes) {
+      const level = Math.max(0, ...parents.get(n.id).map(e => levels.get(e.from) + 1));
+      levels.set(n.id, level);
+      const row = rows.get(level) || 0; rows.set(level, row + 1);
+      positions.set(n.id, { x: 24 + row * 236, y: 24 + level * 112 });
+    }
+    const width = Math.max(500, Math.max(...rows.values()) * 236 + 24), height = (Math.max(...levels.values()) + 1) * 112 + 24;
+    const edges = graph.edges.map(e => {
+      const a = positions.get(e.from), b = positions.get(e.to);
+      return `<path d="M${a.x + 104} ${a.y + 78} C${a.x + 104} ${a.y + 98},${b.x + 104} ${b.y - 20},${b.x + 104} ${b.y}" marker-end="url(#execution-arrow)"><title>${esc(e.kind)}: ${esc(e.from)} to ${esc(e.to)}</title></path>`;
+    }).join('');
+    const short = value => String(value || '').length > 27 ? String(value).slice(0, 26) + '…' : String(value || '');
+    const boxes = nodes.map(n => {
+      const p = positions.get(n.id);
+      return `<g class="execution-node" role="button" tabindex="0" data-graph-node="${esc(n.id)}" aria-label="${esc(n.kind)} ${esc(n.role || '')}: ${esc(n.status)}. Open recorded details." transform="translate(${p.x},${p.y})"><rect width="208" height="78" rx="6"/><text x="12" y="23">${esc(short(n.role || n.kind))}</text><text x="12" y="45">${esc(n.kind)} · ${esc(n.status)}</text><text x="12" y="64">${esc(n.host || 'controller')}</text></g>`;
+    }).join('');
+    const details = nodes.map(n => `<details class="execution-node-detail" data-graph-detail="${esc(n.id)}"><summary>${esc(n.id)} · ${esc(n.kind)} · ${esc(n.role || 'controller')} · ${esc(n.status)}</summary><dl>`
+      + [['Attempt', n.attemptId], ['Host', n.host], ['Recorded at', n.at], ['Verdict', n.verdict], ['Wave', n.waveId], ['Gates', (n.gates || []).join(', ')],
+        ['Workflow snapshot SHA-256', n.graphDigest], ['Input receipt SHA-256', n.inputDigest], ['Output receipt SHA-256', n.outputDigest],
+        [n.kind === 'reuse' ? 'Historical report SHA-256 (worker not invoked)' : 'Stage context SHA-256', n.contextDigest], ['Result SHA-256', n.resultDigest]]
+        .map(([key, value]) => `<dt>${esc(key)}</dt><dd><code>${esc(value || 'Not recorded')}</code></dd>`).join('')
+      + `<dt>Recorded predecessors</dt><dd>${parents.get(n.id).map(e => `${esc(e.from)} (${esc(e.kind)})`).join(', ') || 'None recorded; not proof of complete external inputs'}</dd></dl></details>`).join('');
+    return `<section class="execution-graph" aria-label="Controller-recorded execution graph"><h3>Controller-recorded graph</h3><p>${nodes.length} nodes · ${graph.edges.length} recorded edges · ${graph.snapshots?.length || 0} workflow snapshots. ${graph.complete ? 'Controller history recorded from run creation.' : 'Partial history: missing edges are not inferred.'}</p>`
+      + `<p class="work-meta">Dispatch, input, verification, gate and join edges describe controller observations. Intent is not proof of a live worker; recorded approval is not deployment or task acceptance. Historical reuse does not invoke a worker. Stage context digests exclude separately admitted domain packets.</p>`
+      + (graph.reason ? `<p class="work-warning">${esc(graph.reason)}</p>` : '')
+      + `<div class="execution-graph-tools" role="group" aria-label="Graph zoom"><button type="button" class="gate-btn" data-graph-scale="0.75">Zoom out</button><button type="button" class="gate-btn" data-graph-scale="1.333333">Zoom in</button><button type="button" class="gate-btn" data-graph-scale="reset">Reset zoom</button></div>`
+      + `<div class="execution-graph-canvas" tabindex="0" aria-label="Scrollable graph. Tab to a node and press Enter for details."><svg width="${width}" height="${height}" viewBox="0 0 ${width} ${height}" role="group" aria-label="Recorded execution dependencies"><defs><marker id="execution-arrow" markerWidth="8" markerHeight="8" refX="7" refY="4" orient="auto"><path d="M0 0 L8 4 L0 8"/></marker></defs><g class="execution-edges" fill="none">${edges}</g>${boxes}</svg></div>`
+      + `<h3>Recorded node details</h3><p class="work-meta">Use the graph or expand a node below. Digests bind recorded inputs, not correctness.</p>${details}</section>`;
+  }
+  function graphInteraction(target) {
+    const node = target.closest('[data-graph-node]');
+    if (node?.dataset.graphNode) {
+      const detail = [...document.querySelectorAll('[data-graph-detail]')].find(el => el.dataset.graphDetail === node.dataset.graphNode);
+      if (detail) { detail.open = true; detail.querySelector('summary')?.focus(); detail.scrollIntoView({ block: 'nearest' }); }
+      return true;
+    }
+    const scale = target.closest('[data-graph-scale]');
+    if (!scale?.dataset.graphScale) return false;
+    const svg = scale.closest('.execution-graph').querySelector('svg'), bounds = svg.viewBox.baseVal;
+    const next = scale.dataset.graphScale === 'reset' ? 1 : Math.min(2, Math.max(0.25, Number(svg.dataset.zoom || 1) * Number(scale.dataset.graphScale)));
+    svg.dataset.zoom = String(next); svg.setAttribute('width', String(bounds.width * next)); svg.setAttribute('height', String(bounds.height * next));
+    return true;
+  }
   function renderCockpit(data, options = {}) {
     const category = categories.some(([key]) => key === options.category) ? options.category : 'active';
     const tab = ['overview', 'execution', 'evidence'].includes(options.tab) ? options.tab : 'overview';
@@ -207,6 +262,7 @@
       document.getElementById('work-command').textContent = ''; status('');
     });
     for (const id of ['work-list', 'history-list']) document.getElementById(id).addEventListener('click', event => {
+      if (graphInteraction(event.target)) return;
       if (!snapshot) return;
       const button = event.target.closest('[data-work-action]');
       if (!button?.dataset.workAction) {
@@ -227,6 +283,7 @@
       else options.openIssue(entry.issueIds[0], action.action === 'review_decision');
     });
     document.getElementById('work-list').addEventListener('keydown', event => {
+      if (['Enter', ' '].includes(event.key) && event.target.closest('[data-graph-node]')) { event.preventDefault(); graphInteraction(event.target); return; }
       const button = event.target.closest('[data-work-tab]');
       if (!button || !['ArrowLeft', 'ArrowRight', 'Home', 'End'].includes(event.key)) return;
       const tabs = ['overview', 'execution', 'evidence'], current = tabs.indexOf(button.dataset.workTab);
@@ -238,5 +295,5 @@
     });
     setInterval(() => { if (!document.hidden && options.visible()) refresh(); }, 10000);
   }
-  window.GctoWork = { bind, refresh, reset, render, renderCockpit, commandFor, publicationCommand, getSnapshot() { return snapshot; }, showCompleted() { category = 'completed'; selectedKey = null; tab = 'overview'; paint(); }, search(value) { filter = value; paint(); } };
+  window.GctoWork = { bind, refresh, reset, render, renderCockpit, renderExecutionGraph, commandFor, publicationCommand, getSnapshot() { return snapshot; }, showCompleted() { category = 'completed'; selectedKey = null; tab = 'overview'; paint(); }, search(value) { filter = value; paint(); } };
 })();

package/board/packages/board/public/index.html

@@ -8029,7 +8029,9 @@ async function init() {
   resetProjectUsage();
   if (currentTab === 'usage') loadUsage();
   if (currentTab === 'skills') loadSkillsInventory();
-  window.GctoWork.reset();
+  // Work already reads the URL's project during bind(). Late bootstrap data
+  // must refresh that same scope, not erase an Execution/Evidence selection.
+  window.GctoWork.refresh();
   document.getElementById('project-name').textContent = proj;
   document.getElementById('crumb-project').textContent = proj;
   document.title = `${proj} · great_cto`;

package/board/scripts/codex-pipeline.mjs

@@ -8,6 +8,7 @@ import { codexRunStore, listCodexRuns, codexHostDoctor } from './lib/codex-host-
 import { beginWork, finishWork, acquireProjectLease, readWorkTask, linkWork, observeWorkRun, controlledDecisions } from './lib/work-tasks.mjs';
 import { detectClaude } from './lib/claude-exec.mjs';
 import { dispatchEvidenceSummary } from './lib/controller-dispatch-evidence.mjs';
+import { projectExecutionTrace } from './lib/execution-trace.mjs';
 import { readBenchmarkRegistration, bindBenchmarkTrial } from './lib/adaptive-benchmark-collector.mjs';
 import { readDomainPolicy } from './lib/domain-admission.mjs';
 
@@ -163,6 +164,7 @@ try {
   }
   console.log(JSON.stringify({ id: state.id, status: state.status, reason: state.reason,
     controllerDispatch: dispatchEvidenceSummary(state),
+    executionGraph: projectExecutionTrace(state),
     release: state.release ? { status: state.release.status, token: state.release.token, adapter: state.release.adapter,
       artifactDigest: state.release.artifactDigest, target: state.release.target, path: state.release.path, url: state.release.url,
       activation: state.release.activation, rollback: state.release.rollback } : null,

package/board/scripts/lib/codex-host-state.mjs

@@ -6,6 +6,7 @@ import { spawnSync } from 'node:child_process';
 import { detectCodex } from './codex-exec.mjs';
 import { detectClaude } from './claude-exec.mjs';
 import { dispatchEvidenceSummary } from './controller-dispatch-evidence.mjs';
+import { projectExecutionTrace } from './execution-trace.mjs';
 
 export const codexRunStore = ({ home = homedir(), env = process.env } = {}) =>
   env.GREAT_CTO_CODEX_RUNS_DIR || join(home, '.great_cto', 'codex-runs');
@@ -21,6 +22,7 @@ export function projectCodexState(state) {
     queue: state.queue || [],
     hostRoutes: state.hostRoutes || {},
     controllerDispatch: dispatchEvidenceSummary(state),
+    executionGraph: projectExecutionTrace(state),
     wave: state.wave ? { id: state.wave.id, roles: state.wave.roles, hosts: state.wave.hosts, status: state.wave.status } : null,
     rolesCompleted: Object.keys(state.results || {}),
     attempts: (state.attempts || []).map(({ id, role, host, number, phase, status, startedAt, finishedAt, invocationId }) =>

package/board/scripts/lib/codex-pipeline.mjs

@@ -20,6 +20,7 @@ import { scopedReviewInput, scopedReviewCandidate, attestScopedReview, completeS
 import { observeControllerCall } from './controller-dispatch-evidence.mjs';
 import { invocationIdentity } from './invocation-identity.mjs';
 import { bindDomainPolicy, domainInvocation } from './domain-admission.mjs';
+import { initializeTrace, recordTrace, traceAttempt, traceKey, traceIncoming, traceSchedule, traceParents, traceGate, traceApproval } from './execution-trace.mjs';
 
 export const PLUGIN_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
 const hash = text => createHash('sha256').update(text).digest('hex');
@@ -279,6 +280,7 @@ export function newRun({ root, prompt, allowed, entry = 'product-owner', pluginR
   if (specialistPolicy) { state.specialistGraph = structuredClone(graph); validateSpecialistPolicy(state, specialistPolicy); }
   state.hostRoutes = validateRoutes(hostRoutes, state.graph);
   if (domainPolicy) state.domainAdmission = bindDomainPolicy(root, domainPolicy);
+  initializeTrace(state);
   return state;
 }
 
@@ -303,6 +305,9 @@ function descendants(state, role) {
 
 function rewind(state, target, feedback) {
   if (!state.graph[target] || target.includes('.') || externalRoles.has(target)) throw Error('invalid repair target');
+  const cause = recordTrace(state, 'rework', { role: target, status: 'rework',
+    parents: [traceKey(state, `result:${feedback?.attemptId}`), traceKey(state, `attempt:${feedback?.attemptId}`),
+      ...traceParents(state, [feedback?.role])], relation: 'retry' });
   const used = (state.attempts || []).filter(a => a.role === target).length;
   if (used >= (state.maxAttempts ?? 1)) {
     state.status = 'blocked'; state.reason = `repair attempt limit reached for ${target}`; return;
@@ -316,13 +321,19 @@ function rewind(state, target, feedback) {
     state.invalidations.at(-1).release = state.release;
     state.release = null;
   }
-  for (const role of affected) delete state.results[role];
+  for (const role of affected) {
+    delete state.results[role];
+    // Retain historical nodes, not invalidated scheduling authority. A queued
+    // partner may never have dispatched and therefore still have old inputs.
+    traceSchedule(state, role, []);
+  }
   state.approvals = state.approvals.filter(a => !affected.has(a.role));
   state.released = state.released.filter(role => !affected.has(role));
   // Replace all affected work, including a not-yet-run join partner. It will be
   // scheduled again by the repaired predecessor, never mixed with old evidence.
   state.queue = [target, ...state.queue.filter(role => !affected.has(role))];
   state.pending = null; state.active = null; state.rework = feedback;
+  traceSchedule(state, target, [cause]);
   state.status = 'ready'; delete state.reason;
   if (state.specialistPolicy && target === 'senior-dev') {
     state.graph = structuredClone(state.specialistImplementationGraph || state.specialistGraph); delete state.specialistReview;
@@ -382,6 +393,10 @@ export function recover(state) {
     state.waveHistory ??= [];
     state.waveHistory.push({ id: wave.id, roles: [...roles], hosts: { ...wave.hosts },
       status: 'blocked', reason: state.reason, receipt: wave.receipt, recoveredAt: new Date().toISOString() });
+    const recovery = recordTrace(state, 'recovery', { status: 'recovered',
+      parents: [traceKey(state, `wave:${wave.id}`), ...roles.map(role => traceKey(state, `dispatch:${wave.attemptIds?.[role]}`))],
+      relation: 'recovery', input: current });
+    for (const role of roles) traceSchedule(state, role, [recovery]);
     state.wave = null; state.status = 'ready'; delete state.reason;
     return;
   }
@@ -396,11 +411,19 @@ export function recover(state) {
   if (!completeReceipt(currentReceipt) || JSON.stringify(currentReceipt) !== JSON.stringify(expected)) throw Error('recovery refused: working tree changed or receipt unavailable');
   if (state.attempts.filter(a => a.role === state.active).length >= (state.maxAttempts ?? 1)) throw Error('recovery attempt limit reached');
   attempt.status = 'recovered'; attempt.recoveredAt = new Date().toISOString();
+  const recovery = recordTrace(state, 'recovery', { role: attempt.role, attemptId: attempt.id, status: 'recovered',
+    parents: [traceKey(state, `failure:${attempt.id}`) || traceKey(state, `result:${attempt.id}`) || traceKey(state, `attempt:${attempt.id}`)], relation: 'recovery', input: currentReceipt });
+  traceSchedule(state, attempt.role, [recovery]);
   state.active = null; state.status = 'ready'; delete state.reason;
 }
 
 export function cancel(state) {
   if (state.status === 'done') throw Error('completed run cannot be cancelled');
+  recordTrace(state, 'cancel', { status: 'cancelled', parents: [
+    state.pending ? traceGate(state) : null,
+    ...(state.attempts || []).filter(a => a.status === 'running').map(a => traceKey(state, `attempt:${a.id}`)),
+    state.wave ? traceKey(state, `wave:${state.wave.id}`) : null,
+  ], relation: 'cancel' });
   state.cancelledAt = new Date().toISOString(); state.status = 'cancelled';
   state.pending = null;
   if (state.release && state.release.status !== 'verified') { state.release.status = 'cancelled'; delete state.release.token; }
@@ -466,9 +489,12 @@ export function advance(state) {
         state.status = 'blocked'; state.reason = 'graph cannot enforce high-risk gate floor'; return;
       }
     }
-    for (const g of declared.filter(g => !applicable.includes(g))) {
+    const skipped = declared.filter(g => !applicable.includes(g));
+    for (const g of skipped) {
       if (state.gatePolicy && !state.gatePolicy.skipped.includes(g)) state.gatePolicy.skipped.push(g);
     }
+    const skippedNode = skipped.length ? recordTrace(state, 'gate', { key: `skipped:${role}:${result.digest}`, role, status: 'skipped',
+      gates: skipped, parents: traceParents(state, [role, ...joined]), relation: 'gate', resultDigest: result.digest }) : null;
     const gates = applicable.filter(gate => !state.approvals.some(a => a.role === role && a.gate === gate && a.result === result.digest));
     if (gates.length) {
       const receipt = treeReceipt(state.root);
@@ -485,14 +511,18 @@ export function advance(state) {
       // Found by walking shared/pipeline.toml end to end; the two-role fixture
       // has no join and could not see it.
       state.pending = { token: randomUUID(), role, gates, result: result.digest, receipt };
+      traceGate(state);
       state.status = 'awaiting-gate'; return;
     }
     state.released.push(role);
+    const transition = recordTrace(state, 'transition', { key: `transition:${role}:${result.digest}`, role, verdict: result.verdict,
+      resultDigest: result.digest, parents: [...traceParents(state, [role, ...joined]), skippedNode], relation: joined.length ? 'join' : 'transition' });
     for (const next of list(rule.next)) {
       if (state.results[next] && state.graph[`${role}.${result.verdict}`]) {
         rewind(state, next, { role, verdict: result.verdict, summary: result.summary }); return;
       }
       if (!state.results[next] && !state.queue.includes(next)) state.queue.push(next);
+      if (!state.results[next]) traceSchedule(state, next, [transition], true);
     }
   }
   try { schedulePreparation(state); }
@@ -527,6 +557,7 @@ function assertPendingGate(state, token) {
 
 export function approve(state, token) {
   const { role, gates, result } = assertPendingGate(state, token);
+  traceApproval(state, state.pending);
   for (const gate of gates) state.approvals.push({ role, gate, result, at: new Date().toISOString() });
   state.pending = null;
   advance(state);
@@ -538,12 +569,14 @@ export function reject(state, token, reason) {
   const { role } = assertPendingGate(state, token);
   if (!state.graph[role] || externalRoles.has(role) || role.includes('.')) throw Error('gate cannot be reworked by this controller');
   const pending = structuredClone(state.pending);
+  const rejected = traceApproval(state, pending, true);
   const modulePath = fileURLToPath(import.meta.url);
   const feedback = { kind: 'operator-rejection', role, reason: reason.trim(), pending,
     controller: { modulePath, sha256: hash(readFileSync(modulePath)) }, at: new Date().toISOString() };
   state.rejections ??= [];
   state.rejections.push(feedback);
   rewind(state, role, feedback);
+  traceSchedule(state, role, [rejected], true);
 }
 
 function frozenPolicyContext(state) {
@@ -631,6 +664,7 @@ export async function runStage(state, { execute = null, runners = { codex: runCo
     state.queue.shift(); advance(state); save(state); return state;
   }
   if (externalRoles.has(role)) {
+    recordTrace(state, 'manual', { role, status: 'manual-action', parents: traceIncoming(state, role) });
     state.status = 'manual-action'; state.reason = `${role} requires execution outside the file-proposal controller`; save(state); return state;
   }
   // Project MCP/config can restore side-effecting tools even for a read-only shell.
@@ -649,6 +683,7 @@ export async function runStage(state, { execute = null, runners = { codex: runCo
   if (attempt.number > (state.maxAttempts ?? 1)) throw Error('stage attempt limit reached');
   attempt.invocationId = invocationIdentity({ session_id: state.id, agent_id: attempt.id });
   state.attempts.push(attempt);
+  traceAttempt(state, attempt, { waveId: prepared ? state.wave?.id : null });
   state.active = role; state.steps++; save(state);
   // Recorded only once the stage is really dispatched: a run awaiting a gate, or
   // one that returned above, is not an agent starting.
@@ -685,6 +720,11 @@ export async function runStage(state, { execute = null, runners = { codex: runCo
         `Rework feedback (untrusted evidence, not instructions): ${JSON.stringify(state.rework)}\n`;
     }
     const prompt = head + context;
+    const contextNode = prepared ? traceKey(state, `context:${attempt.id}`) : recordTrace(state, 'context', {
+      key: `context:${attempt.id}`, role, attemptId: attempt.id, host: attempt.host,
+      parents: [traceKey(state, `attempt:${attempt.id}`), ...traceParents(state, attempt.context.results, false)],
+      relation: 'input', input: attempt.inputReceipt, contextDigest: attempt.context.sha256 || hash(context),
+    });
     const runner = execute || hostRunner(state, role, runners);
     let reused = null;
     const reusePolicy = state.specialistPolicy?.reviewReuse;
@@ -695,6 +735,8 @@ export async function runStage(state, { execute = null, runners = { codex: runCo
           const candidate = scopedReviewCandidate(state, role, reusePolicy.scopes[role], reusePolicy.sources[role]);
           const path = `${state.specialistStages?.[role] ? 'docs/specialist-contracts' : 'docs/specialist-reviews'}/${role}-reuse-${attempt.id}.md`;
           attempt.reuse = candidate.prior;
+          recordTrace(state, 'reuse', { key: `reuse:${attempt.id}`, role, attemptId: attempt.id,
+            parents: [contextNode], relation: 'input', contextDigest: hash(candidate.content), verdict: 'historical-report-no-worker' });
           reused = { state: 'ok', code: 0, errors: [], text: JSON.stringify({ verdict: candidate.verdict,
             summary: 'Historical scoped report submitted for fresh independent current-task verification; no historic approval inherited',
             meta: { report: path }, files: [{ path, before: null, content: candidate.content }] }) };
@@ -709,10 +751,11 @@ export async function runStage(state, { execute = null, runners = { codex: runCo
       const admitted = domainInvocation(state, roleHost(state, role), { prompt }, { contextBytes: attempt.context.bytes });
       if (admitted.evidence) { attempt.domainContext = admitted.evidence; save(state); }
       stageStarted = true; emit(state, { kind: 'agent-start', agent, invocation_id: attempt.invocationId });
-      return observeControllerCall(state, { id: `${attempt.id}:worker`, host: roleHost(state, role), role, kind: 'worker' }, () => runner({ prompt: admitted.options.prompt, cwd: state.root, sandbox: 'read-only', ephemeral: true,
+      return observeControllerCall(state, { id: `${attempt.id}:worker`, attemptId: attempt.id, host: roleHost(state, role), role, kind: 'worker' }, () => runner({ prompt: admitted.options.prompt, cwd: state.root, sandbox: 'read-only', ephemeral: true,
       bin: roleHost(state, role) === 'codex' ? process.env.GREAT_CTO_CODEX_BIN || 'codex' : process.env.GREAT_CTO_CLAUDE_BIN || 'claude',
       invocationId: attempt.invocationId, timeoutMs: 300000, extraArgs: roleHost(state, role) === 'codex' ? workerArgs : [], onEvent: toolListener(state, agent, attempt.invocationId) }), save);
     });
+    const proposalSource = traceKey(state, `dispatch:${attempt.id}`) || traceKey(state, `reuse:${attempt.id}`) || contextNode;
     // Codex can recover its session-index lookup without degrading the worker.
     // Keep the diagnostic in the receipt; every other warning/error blocks.
     const proposal = cleanResponse(response);
@@ -724,6 +767,8 @@ export async function runStage(state, { execute = null, runners = { codex: runCo
     const rule = state.graph[`${role}.${proposal.verdict}`] || state.graph[role];
     if (['FAIL', 'REJECTED'].includes(proposal.verdict) && repairTarget(state, role) !== role) {
       Object.assign(attempt, { status: 'rework', verdict: proposal.verdict, summary: proposal.summary, finishedAt: new Date().toISOString() });
+      recordTrace(state, 'result', { key: `result:${attempt.id}`, role, attemptId: attempt.id, host: attempt.host,
+        status: 'rework', parents: [proposalSource], relation: 'outcome', verdict: proposal.verdict });
       // A negative reviewer verdict cannot write or approve anything. It can
       // only request bounded repair through the controller-owned route.
       rewind(state, repairTarget(state, role), { role, attemptId: attempt.id, verdict: proposal.verdict, summary: proposal.summary });
@@ -780,15 +825,23 @@ export async function runStage(state, { execute = null, runners = { codex: runCo
       attempt.phase = 'checking'; save(state);
       attempt.checks = await checks(state, { safePath });
       if (!['passed', 'failed', 'unverifiable'].includes(attempt.checks?.state)) throw Error('invalid checks evidence');
+      recordTrace(state, 'checks', { key: `checks:${attempt.id}`, role, attemptId: attempt.id, status: attempt.checks.state,
+        parents: [proposalSource], relation: 'checks', input: receipt });
       save(state);
     }
     attempt.phase = 'verifying'; save(state);
     const beforeVerifier = stageReceipt(state, treeReceipt(state.root), 'verifier input');
     if (JSON.stringify(beforeVerifier) !== JSON.stringify(receipt)) throw Error('working tree changed before verification');
+    if (!attempt.checks || attempt.checks.state === 'passed') {
+      recordTrace(state, 'verifier', { key: `verifier:${attempt.id}`, role, attemptId: attempt.id, host: 'codex', status: 'intent',
+        parents: [traceKey(state, `checks:${attempt.id}`) || proposalSource,
+          ...traceParents(state, Object.keys(state.results), false)], relation: 'verification', input: receipt });
+      save(state);
+    }
     let verification = attempt.checks && attempt.checks.state !== 'passed'
       ? { state: attempt.checks.state === 'failed' ? 'rework' : 'unverifiable', findings: [`Required checks ${attempt.checks.state}: ${JSON.stringify(checkSummary(attempt.checks))}`], checks: ['controller executed mandatory checks'] }
       : await withAgentBudget(state, { callId: `${attempt.id}:verifier`, host: 'codex', role: 'codex-verifier' }, () =>
-        observeControllerCall(state, { id: `${attempt.id}:verifier`, host: 'codex', role: 'codex-verifier', kind: 'verifier' },
+        observeControllerCall(state, { id: `${attempt.id}:verifier`, attemptId: attempt.id, host: 'codex', role: 'codex-verifier', kind: 'verifier' },
           () => verify(state, role, proposal, execute || runCodexExec), save));
     if (!['verified', 'rework', 'unverifiable'].includes(verification?.state) || !Array.isArray(verification.findings) ||
         !Array.isArray(verification.checks) || !verification.checks.length) throw Error('invalid or empty verifier evidence');
@@ -799,6 +852,9 @@ export async function runStage(state, { execute = null, runners = { codex: runCo
     }
     state.verification = verification;
     Object.assign(attempt, { verification, receipt, proposalDigest: hash(JSON.stringify(proposal)), finishedAt: new Date().toISOString() });
+    recordTrace(state, 'result', { key: `result:${attempt.id}`, role, attemptId: attempt.id, host: attempt.host, status: verification.state,
+      parents: [traceKey(state, `verifier-call:${attempt.id}`) || traceKey(state, `checks:${attempt.id}`)],
+      relation: 'outcome', input: attempt.inputReceipt, output: receipt, resultDigest: hash(JSON.stringify({ attemptId: attempt.id, proposal })), verdict: proposal.verdict });
     if (verification.state === 'rework') {
       attempt.status = 'rework';
       const feedback = { role, attemptId: attempt.id, findings: verification.findings, checks: verification.checks };
@@ -808,6 +864,8 @@ export async function runStage(state, { execute = null, runners = { codex: runCo
       if (target !== role) {
         rewind(state, target, feedback);
       } else if (attempt.number < (state.maxAttempts ?? 1)) {
+        traceSchedule(state, role, [recordTrace(state, 'rework', { role, attemptId: attempt.id, status: 'rework',
+          parents: [traceKey(state, `result:${attempt.id}`)], relation: 'retry' })]);
         state.status = 'ready'; delete state.reason;
       } else {
         state.status = 'blocked'; state.reason = `verifier rework limit reached for ${role}: ${JSON.stringify(verification.findings)}`;
@@ -838,6 +896,8 @@ export async function runStage(state, { execute = null, runners = { codex: runCo
   } catch (error) {
     Object.assign(attempt, { status: 'blocked', reason: error.message, finishedAt: new Date().toISOString() });
     state.status = 'blocked'; state.reason = error.message;
+    recordTrace(state, 'result', { key: `failure:${attempt.id}`, role, attemptId: attempt.id, host: attempt.host, status: 'blocked',
+      parents: [traceKey(state, `result:${attempt.id}`) || traceKey(state, `verifier-call:${attempt.id}`) || traceKey(state, `verifier:${attempt.id}`) || traceKey(state, `checks:${attempt.id}`) || traceKey(state, `dispatch:${attempt.id}`) || traceKey(state, `reuse:${attempt.id}`) || traceKey(state, `context:${attempt.id}`) || traceKey(state, `attempt:${attempt.id}`)], relation: 'outcome' });
     // Keep active set: a partial write or interrupted process must not be replayed.
     save(state);
   } finally {
@@ -915,6 +975,14 @@ export async function runParallelWave(state, { runners = { codex: runCodexExec,
       hosts: Object.fromEntries(roles.map(role => [role, roleHost(state, role)])), startedAt: new Date().toISOString() };
     const context = inlineContext(state);
     state.wave.context = context;
+    const waveNode = recordTrace(state, 'wave', { key: `wave:${waveId}`, waveId, status: 'intent', input: receipt,
+      parents: roles.flatMap(role => traceIncoming(state, role)), relation: 'wave' });
+    for (const role of roles) {
+      const id = state.wave.attemptIds[role];
+      const attemptNode = traceAttempt(state, { id, role, host: roleHost(state, role), inputReceipt: receipt }, { parents: [waveNode], waveId });
+      recordTrace(state, 'context', { key: `context:${id}`, role, attemptId: id, host: roleHost(state, role), waveId,
+        parents: [attemptNode, ...traceParents(state, context.record.results, false)], relation: 'input', input: receipt, contextDigest: context.record.sha256 });
+    }
     try { save(state); } catch (error) { for (const lease of leases) releaseAgent(state.executionBudget, lease); throw error; }
     const calls = roles.map(async (role, index) => {
       const agent = hostAgent(state, role), started = Date.now();
@@ -927,7 +995,7 @@ export async function runParallelWave(state, { runners = { codex: runCodexExec,
         const admitted = domainInvocation(state, roleHost(state, role), { prompt: workerHead(state, role) + context.text }, { contextBytes: context.record.bytes });
         if (admitted.evidence) { state.wave.domainContexts ??= {}; state.wave.domainContexts[role] = admitted.evidence; save(state); }
         emit(state, { kind: 'agent-start', agent, invocation_id: invocationId }); startedHost = true;
-        const result = await observeControllerCall(state, { id: `${waveId}:${role}`, host: roleHost(state, role), role, kind: 'worker' }, () => runner({ prompt: admitted.options.prompt, cwd: state.root,
+        const result = await observeControllerCall(state, { id: `${waveId}:${role}`, attemptId: state.wave.attemptIds[role], host: roleHost(state, role), role, kind: 'worker' }, () => runner({ prompt: admitted.options.prompt, cwd: state.root,
           sandbox: 'read-only', ephemeral: true, timeoutMs: 300000,
           bin: roleHost(state, role) === 'codex' ? process.env.GREAT_CTO_CODEX_BIN || 'codex' : process.env.GREAT_CTO_CLAUDE_BIN || 'claude',
           invocationId, extraArgs: roleHost(state, role) === 'codex' ? workerArgs : [], onEvent: toolListener(state, agent, invocationId) }), save);

package/board/scripts/lib/codex-release.mjs

@@ -6,6 +6,7 @@ import { validateArtifacts, bundleDigest, digest, artifactPath } from './codex-a
 import { validateCheckPolicy, runChecks } from './codex-checks.mjs';
 import { treeReceipt } from './receipt.mjs';
 import { publishGitHubRelease } from './codex-github-release.mjs';
+import { recordTrace, traceKey, traceIncoming, traceSchedule } from './execution-trace.mjs';
 const ROOT_MARKER = '.great-cto-release-root';
 const ROOT_MARKER_CONTENT = 'great-cto-release-root:v1\n';
 const backendFields = policy => policy.backend === 'local'
@@ -83,11 +84,16 @@ export function prepareRelease(state) {
   const r = state.release;
   r.bindingDigest = digest(JSON.stringify({ id: r.id, target: r.target, policyDigest: r.policyDigest, artifactDigest: r.artifactDigest, receipt: r.receipt }));
   state.status = 'awaiting-release';
+  recordTrace(state, 'gate', { key: `release:${r.id}:gate`, role: 'devops', status: 'pending',
+    parents: traceIncoming(state, 'devops'), relation: 'gate', input: receipt, resultDigest: r.artifactDigest, gates: ['gate:release'] });
 }
 
 export function approveRelease(state, token) {
   const r = assertRelease(state);
   if (state.status !== 'awaiting-release' || r.status !== 'awaiting-approval' || token !== r.token) throw Error('release approval token does not match');
+  const approved = recordTrace(state, 'approval', { key: `release:${r.id}:approval`, role: 'devops', status: 'approved',
+    parents: [traceKey(state, `release:${r.id}:gate`)], relation: 'approval', input: r.receipt, resultDigest: r.artifactDigest, gates: ['gate:release'] });
+  traceSchedule(state, 'devops', [approved]);
   r.approvedAt = new Date().toISOString(); r.status = 'approved'; delete r.token;
   state.status = 'ready';
 }
@@ -113,6 +119,9 @@ function verifyDirectory(path, artifacts) {
 export function recoverRelease(state) {
   const r = assertRelease(state);
   if (!r.approvedAt || !['publishing', 'failed'].includes(r.status)) throw Error('release is not recoverable');
+  const recovery = recordTrace(state, 'recovery', { role: 'devops', status: 'recovered',
+    parents: traceIncoming(state, 'devops'), relation: 'recovery', input: r.receipt, resultDigest: r.artifactDigest });
+  traceSchedule(state, 'devops', [recovery]);
   // Reuse operation ID and candidate; never rebuild or approve a replacement.
   state.status = 'ready'; delete state.reason;
 }
@@ -120,6 +129,7 @@ export function recoverRelease(state) {
 export async function executeRelease(state, { safePath, checks = runChecks, gh, save = () => {} } = {}) {
   const r = assertRelease(state);
   if (!r.approvedAt || !['approved', 'publishing', 'failed', 'verified'].includes(r.status)) throw Error('release was not approved');
+  const publication = recordTrace(state, 'release', { role: 'devops', status: 'intent', parents: traceIncoming(state, 'devops'), relation: 'release', input: r.receipt, resultDigest: r.artifactDigest });
   r.status = 'publishing'; save(state);
   if (r.adapter === 'github-release') {
     try {
@@ -131,8 +141,11 @@ export async function executeRelease(state, { safePath, checks = runChecks, gh,
       }, { safePath }) });
       Object.assign(r, { url: published.url, remoteAssets: published.remoteAssets, smoke: published.smoke,
         publishedAt: r.publishedAt ?? new Date().toISOString(), status: 'verified', verifiedAt: new Date().toISOString() });
-      assertRelease(state); save(state); return r;
+      assertRelease(state);
+      recordTrace(state, 'release', { key: `release:${r.id}:published`, role: 'devops', status: 'published', parents: [publication], relation: 'release', resultDigest: r.artifactDigest });
+      save(state); return r;
     } catch (error) {
+      traceSchedule(state, 'devops', [recordTrace(state, 'release', { role: 'devops', status: 'failed', parents: [publication], relation: 'release', resultDigest: r.artifactDigest })]);
       r.status = 'failed'; state.status = 'blocked'; state.reason = error.message; save(state); throw error;
     }
   }
@@ -160,8 +173,10 @@ export async function executeRelease(state, { safePath, checks = runChecks, gh,
     if (r.smoke?.state !== 'passed' || r.smoke.code !== 0) throw Error('post-release smoke did not pass');
     assertRelease(state);
     r.status = 'verified'; r.verifiedAt = new Date().toISOString();
+    recordTrace(state, 'release', { key: `release:${r.id}:published`, role: 'devops', status: 'published', parents: [publication], relation: 'release', resultDigest: r.artifactDigest });
     save(state); return r;
   } catch (error) {
+    traceSchedule(state, 'devops', [recordTrace(state, 'release', { role: 'devops', status: 'failed', parents: [publication], relation: 'release', resultDigest: r.artifactDigest })]);
     r.status = 'failed'; state.status = 'blocked'; state.reason = error.message; save(state); throw error;
   } finally {
     // Only this invocation's private staging directory is discarded. A published

package/board/scripts/lib/controlled-specialists.mjs

@@ -8,6 +8,7 @@ import { RULES } from '../hooks/auto-attach-reviewers.mjs';
 import { codexRoleProfile } from './codex-role-profiles.mjs';
 import { validateReviewReusePolicy } from './scoped-review-reuse.mjs';
 import { assertReviewGraphFloor, assertPreparationGraphFloor } from './review-graph-floor.mjs';
+import { recordTrace, traceIncoming, traceParents, traceSchedule } from './execution-trace.mjs';
 
 const mandatory = ['code-reviewer', 'qa-engineer', 'security-officer'];
 const contracts = new Set(['auth-engineer', 'subscription-billing-engineer', 'integrations-engineer', 'connector-builder',
@@ -82,7 +83,12 @@ export function schedulePreparation(state) {
   state.specialistPreparation = { roles, selected, fingerprint: plan.fingerprint, plan, hardGates: gates,
     reports: [], status: roles.length ? 'scheduled' : 'complete', reusablePass: false };
   state.specialistImplementationGraph = structuredClone(state.graph);
-  if (roles.length) state.queue.splice(state.queue.indexOf('senior-dev'), 1, ...roles);
+  if (roles.length) {
+    state.queue.splice(state.queue.indexOf('senior-dev'), 1, ...roles);
+    const admission = recordTrace(state, 'transition', { role: 'senior-dev',
+      parents: [...traceIncoming(state, 'senior-dev'), ...traceParents(state, Object.keys(state.results))] });
+    for (const role of roles) traceSchedule(state, role, [admission]);
+  }
 }
 
 export function specialistRole(state, role) { return state.specialistStages?.[role]?.role || role; }

package/board/scripts/lib/controller-dispatch-evidence.mjs

@@ -1,4 +1,5 @@
 /** Controller invocation evidence, not provider API usage or quality scores. */
+import { recordTrace, traceKey } from './execution-trace.mjs';
 const hosts = new Set(['codex', 'claude-code']);
 const kinds = new Set(['worker', 'verifier']);
 
@@ -23,6 +24,11 @@ export async function observeControllerCall(state, identity, run, save = () => {
     throw error;
   } finally {
     record.finishedAt = new Date().toISOString();
+    if (identity.attemptId) recordTrace(state, 'result', {
+      key: `${identity.kind === 'worker' ? 'dispatch' : 'verifier-call'}:${identity.attemptId}`,
+      role: identity.role, attemptId: identity.attemptId, host: identity.host, status: record.outcome,
+      parents: [traceKey(state, `${identity.kind === 'worker' ? 'context' : 'verifier'}:${identity.attemptId}`)], relation: 'outcome',
+    });
     save(state);
   }
 }

package/board/scripts/lib/execution-trace.mjs

@@ -0,0 +1,146 @@
+/** Controller-owned observations. Never an execution or approval authority. */
+import { createHash } from 'node:crypto';
+
+export const TRACE_LIMITS = Object.freeze({ nodes: 512, edges: 2048, snapshots: 64 });
+const sha = value => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+const digest = value => /^[a-f0-9]{64}$/.test(value || '') ? value : null;
+const safe = value => typeof value === 'string' && /^[a-zA-Z0-9_.:-]{1,160}$/.test(value) ? value : null;
+const kinds = new Set(['attempt', 'context', 'checks', 'verifier', 'result', 'transition', 'gate', 'approval', 'rework', 'recovery', 'wave', 'manual', 'cancel', 'release', 'reuse']);
+const relations = new Set(['dispatch', 'input', 'checks', 'verification', 'outcome', 'transition', 'join', 'gate', 'approval', 'retry', 'recovery', 'wave', 'cancel', 'release']);
+const statuses = new Set(['intent', 'recorded', 'verified', 'rework', 'unverifiable', 'blocked', 'passed', 'failed', 'pending', 'approved', 'rejected', 'cancelled', 'recovered', 'manual-action', 'returned', 'threw', 'published', 'skipped']);
+const array = value => Array.isArray(value) ? value : value == null ? [] : [value];
+const limited = value => array(value).slice(0, 16).filter(safe);
+
+export function initializeTrace(state) {
+  state.executionTrace = { version: 1, runId: state.id, complete: true, truncated: false,
+    nodes: [], edges: [], snapshots: [], keys: {}, incoming: {}, approved: {} };
+  const entry = recordTrace(state, 'transition', { key: 'entry', role: state.queue?.[0] });
+  for (const role of state.queue || []) traceSchedule(state, role, [entry]);
+  return state.executionTrace;
+}
+function traceFor(state) {
+  const t = state.executionTrace;
+  return t?.version === 1 && t.runId === state.id && Array.isArray(t.nodes) && Array.isArray(t.edges)
+    && Array.isArray(t.snapshots) && [t.keys, t.incoming, t.approved].every(v => v && typeof v === 'object' && !Array.isArray(v)) ? t : null;
+}
+function incomplete(t, truncated = false) { t.complete = false; t.truncated ||= truncated; return null; }
+
+function snapshot(state, t) {
+  const graphDigest = sha(state.graph);
+  if (!t.snapshots.some(s => s.digest === graphDigest)) {
+    if (t.snapshots.length >= TRACE_LIMITS.snapshots) return incomplete(t, true);
+    const rules = Object.entries(state.graph || {});
+    if (rules.length > 256) return incomplete(t, true);
+    if (rules.some(([, r]) => ['on', 'next', 'join', 'gate'].some(k => array(r?.[k]).length > 16))) incomplete(t, true);
+    t.snapshots.push({ digest: graphDigest, sourceHash: digest(state.graphHash), rules: rules.map(([role, rule]) => ({
+      role: safe(role), on: limited(rule.on),
+      next: limited(rule.next), join: limited(rule.join), gates: limited(rule.gate),
+    })) });
+  }
+  return graphDigest;
+}
+
+export const receiptDigest = receipt => receipt && typeof receipt === 'object' ? sha(receipt) : null;
+export const traceKey = (state, key) => { const keys = traceFor(state)?.keys; return keys && Object.hasOwn(keys, key) ? keys[key] : null; };
+export const traceIncoming = (state, role) => { const v = traceFor(state)?.incoming[role]; return Array.isArray(v) ? [...v] : []; };
+export function traceSchedule(state, role, ids, append = false) {
+  const t = traceFor(state); if (!t) return;
+  t.incoming[role] = [...new Set([...(append ? traceIncoming(state, role) : []), ...ids.filter(Boolean)])];
+}
+export function traceParents(state, roles, includeApprovals = true) {
+  const t = traceFor(state); if (!t) return [];
+  return [...new Set(roles.flatMap(role => {
+    const result = state.results?.[role];
+    if (!result) return [];
+    const parent = traceKey(state, `result:${result.attemptId}`) || (role === 'devops' ? traceKey(state, `release:${state.release?.id}:published`) : null);
+    if (!parent) incomplete(t);
+    return [parent, ...(includeApprovals ? array(t.approved[result.digest]) : [])].filter(Boolean);
+  }))];
+}
+
+/** All parent edges are explicit controller decisions, never time-derived. */
+export function recordTrace(state, kind, { key, role = null, attemptId = null, host = null, status = 'recorded',
+  parents = [], relation = 'transition', input = null, output = null, resultDigest = null,
+  contextDigest = null, waveId = null, gates = [], verdict = null } = {}) {
+  const t = traceFor(state);
+  if (!t) return null; // Never invent history for old runs.
+  if (key && Object.hasOwn(t.keys, key)) return t.keys[key];
+  if (!kinds.has(kind) || !statuses.has(status) || !relations.has(relation)) return incomplete(t);
+  if (t.nodes.some(n => !n || typeof n.id !== 'string')) return incomplete(t);
+  const known = new Set(t.nodes.map(n => n.id));
+  const ids = [...new Set(parents.filter(Boolean))];
+  if (ids.some(id => !known.has(id))) return incomplete(t);
+  if (t.nodes.length >= TRACE_LIMITS.nodes || t.edges.length + ids.length > TRACE_LIMITS.edges) return incomplete(t, true);
+  const graphDigest = snapshot(state, t);
+  if (!graphDigest) return null;
+  if (array(gates).length > 16) incomplete(t, true);
+  const id = `node-${t.nodes.length + 1}`;
+  t.nodes.push({ id, kind, role: safe(role), attemptId: safe(attemptId), host: ['codex', 'claude-code'].includes(host) ? host : null,
+    status, at: new Date().toISOString(), graphDigest, inputDigest: receiptDigest(input), outputDigest: receiptDigest(output),
+    resultDigest: digest(resultDigest), contextDigest: digest(contextDigest), waveId: safe(waveId),
+    gates: limited(gates), verdict: safe(verdict) });
+  for (const from of ids) t.edges.push({ from, to: id, kind: relation });
+  if (key) t.keys[key] = id;
+  return id;
+}
+
+export function traceAttempt(state, attempt, { parents = traceIncoming(state, attempt.role), waveId = null } = {}) {
+  const node = recordTrace(state, 'attempt', { key: `attempt:${attempt.id}`, role: attempt.role, attemptId: attempt.id,
+    host: attempt.host, status: 'intent', input: attempt.inputReceipt, parents, relation: waveId ? 'wave' : 'dispatch', waveId });
+  traceSchedule(state, attempt.role, []);
+  return node;
+}
+
+export function traceGate(state) {
+  const p = state.pending; if (!p) return null;
+  const key = `gate:${sha({ role: p.role, result: p.result, gates: p.gates, receipt: p.receipt })}`;
+  const rule = state.graph[`${p.role}.${state.results[p.role]?.verdict}`] || state.graph[p.role];
+  return recordTrace(state, 'gate', { key, role: p.role, status: 'pending', gates: p.gates,
+    parents: traceParents(state, [p.role, ...array(rule?.join)]), relation: 'gate', input: p.receipt, resultDigest: p.result });
+}
+export function traceApproval(state, pending, rejected = false) {
+  const t = traceFor(state); if (!t) return null;
+  const parent = traceGate(state);
+  const id = recordTrace(state, 'approval', { role: pending.role, status: rejected ? 'rejected' : 'approved',
+    parents: [parent], relation: 'approval', input: pending.receipt, resultDigest: pending.result, gates: pending.gates });
+  if (id && !rejected) (t.approved[pending.result] ||= []).push(id);
+  return id;
+}
+
+/** Strict allowlist; no raw prompt, path, receipt map, gate token or report. */
+export function projectExecutionTrace(state) {
+  const t = traceFor(state);
+  const unavailable = reason => ({ state: 'unavailable', complete: false, truncated: false, nodes: [], edges: [], snapshots: [], reason });
+  if (!t) return unavailable('This run has no controller-recorded causal history. Legacy and native observations are not reconstructed.');
+  if (t.nodes.length > TRACE_LIMITS.nodes || t.edges.length > TRACE_LIMITS.edges || t.snapshots.length > TRACE_LIMITS.snapshots)
+    return unavailable('Execution history exceeds the read limit.');
+  const ids = new Set(), snapshots = new Set(t.snapshots.map(s => digest(s?.digest)).filter(Boolean));
+  const nodes = [];
+  for (const n of t.nodes) {
+    if (!n || !safe(n.id) || ids.has(n.id) || !kinds.has(n.kind) || !statuses.has(n.status)
+      || !snapshots.has(n.graphDigest) || array(n.gates).length > 16 || typeof n.at !== 'string' || n.at.length > 40 || !Number.isFinite(Date.parse(n.at))) return unavailable('Execution history is malformed.');
+    ids.add(n.id);
+    nodes.push({ id: n.id, kind: n.kind, role: safe(n.role), attemptId: safe(n.attemptId), host: ['codex', 'claude-code'].includes(n.host) ? n.host : null,
+      status: n.status, at: n.at, graphDigest: n.graphDigest, inputDigest: digest(n.inputDigest), outputDigest: digest(n.outputDigest),
+      resultDigest: digest(n.resultDigest), contextDigest: digest(n.contextDigest), waveId: safe(n.waveId),
+      gates: limited(n.gates), verdict: safe(n.verdict) });
+  }
+  const order = new Map(nodes.map((n, i) => [n.id, i]));
+  const edges = [];
+  for (const e of t.edges) {
+    if (!e || !ids.has(e.from) || !ids.has(e.to) || order.get(e.from) >= order.get(e.to) || !relations.has(e.kind))
+      return unavailable('Execution dependencies are malformed or cyclic.');
+    edges.push({ from: e.from, to: e.to, kind: e.kind });
+  }
+  const projectedSnapshots = [];
+  for (const s of t.snapshots) {
+    if (!digest(s?.digest) || !Array.isArray(s.rules) || s.rules.length > 256) return unavailable('Workflow snapshot is malformed.');
+    if (s.rules.some(r => ['on', 'next', 'join', 'gates'].some(key => array(r?.[key]).length > 16))) return unavailable('Workflow snapshot exceeds nested limits.');
+    projectedSnapshots.push({ digest: s.digest, sourceHash: digest(s.sourceHash), rules: s.rules.map(r => ({
+      role: safe(r?.role), on: limited(r?.on), next: limited(r?.next), join: limited(r?.join), gates: limited(r?.gates),
+    })) });
+  }
+  return { state: nodes.length ? 'recorded' : 'empty', complete: t.complete === true && !t.truncated,
+    truncated: t.truncated === true, nodes, edges, snapshots: projectedSnapshots,
+    reason: t.complete === true && !t.truncated ? null : 'Controller history is incomplete; missing dependencies are not inferred.' };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "3.69.0",
+  "version": "3.70.0",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",