okstra 0.148.1 → 0.149.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okstra",
-  "version": "0.148.1",
+  "version": "0.149.0",
   "description": "Host-aware multi-provider cross-verification orchestrator runtime and agent skills.",
   "license": "MIT",
   "author": "devonshin",

package/runtime/BUILD.json

@@ -1,5 +1,5 @@
 {
-  "package": "0.148.1",
-  "builtAt": "2026-08-04T05:55:30.824Z",
+  "package": "0.149.0",
+  "builtAt": "2026-08-04T18:04:11.228Z",
   "repoRoot": "/home/runner/work/okstra/okstra"
 }

package/runtime/bin/okstra-render-report-views.py

@@ -138,9 +138,29 @@ def _v2_run_meta(data: dict, markdown_path: Path, args: argparse.Namespace):
         task_type,
         seq,
         args.source_report or markdown_path.name,
+        _elapsed_ms(markdown_path, task_type, seq),
     )
 
 
+def _elapsed_ms(markdown_path, task_type: str, seq: str) -> int | None:
+    """Wall-clock milliseconds for this run, or None when it cannot be measured.
+
+    The measurement lives in the run's team-state, not in the report data, so
+    the CLI resolves it here rather than teaching the renderer about run
+    layout. A missing or timestamp-less state yields None — the header then
+    omits the field instead of printing a zero.
+    """
+    from okstra_ctl.report_view_artifacts import team_state_path_for_report
+    from okstra_ctl.time_report import wall_clock_ms
+
+    state_path = team_state_path_for_report(markdown_path, task_type, seq)
+    try:
+        state = json.loads(state_path.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return None
+    return wall_clock_ms(state) or None if isinstance(state, dict) else None
+
+
 def main(argv: list[str] | None = None) -> int:
     parser = argparse.ArgumentParser(
         description="Render the self-contained HTML view of an okstra final-report."

package/runtime/prompts/profiles/project-analysis.md

@@ -18,6 +18,24 @@
   - scan scope and excluded areas
   - components, dependency directions, entry points, repositories, and external integrations
   - shallow feature index and unresolved navigation questions
+- Fill these when the repository states them; leave a block out rather than guessing at it:
+  - `projectAnalysis.techStack` — the languages the project is written in with their
+    versions, the frameworks it runs on, and the package manager, build, test, lint,
+    typecheck, format, CI and container tools. Record where each version was read via
+    `versionSource`: a manifest range (`^1.17.0`) and a lockfile pin are different facts,
+    and a mismatch between a pinned server image and a ranged client is a real
+    compatibility risk that collapses if both are written the same way. A tool the
+    project does not have is not a row — its absence belongs in `qualityCoverage`.
+  - `projectAnalysis.internalInterfaces` — the seams components call across, with the
+    signature a caller writes against. `kind` is what the seam is, not where its file
+    sits: `port` for an abstraction a domain declares, `adapter` for an implementation
+    that satisfies one. `ownerComponentId` and every `consumers` entry must name a
+    component this report declares.
+  - `projectAnalysis.workflows` — one run of real work through the system, start to
+    finish: what triggers it and which component does what, in order. This is the only
+    block that says how the parts are used rather than how they are arranged, so a
+    reader can follow a request without reconstructing it from the dependency graph.
+    Each step's `componentId` must name a declared component.
 - Cross-verification mode:
   - Phase 5.5 convergence runs in adversarial mode (`convergence.adversarial=true`).
 - Non-goals:

package/runtime/prompts/profiles/release-handoff.md

@@ -1,5 +1,8 @@
 # Release Handoff Profile
 
+- Record the handoff shape in `releaseHandoff.handoffScope`: `mode` always, plus `stages`
+  and `collectorBranch` in stage-group mode. The report is the only place a reader learns
+  which stages shipped — the collector branch name does not say.
 - Purpose: take an `accepted` final-verification verdict for an already-committed implementation branch and turn it into a delivered push and/or pull request, with explicit user selection at every mutating step. Two modes: **whole-task** (default — the verified task branch becomes one PR) and **stage-group** (a user-selected subset of verified stages is merged into a collector branch and becomes one PR).
 - **Execution model: single-lead, no worker dispatch.** This phase is a thin orchestrator over `git` / `gh`; it does NOT dispatch teammates, does NOT dispatch analysis or drafter sub-agents, and does NOT run convergence. The host-native Okstra lead performs every step inline (drafting PR text, asking the user, running git / gh, writing the final report) — see "Lead-only contract" below.
 - Worker roster: none — this profile intentionally has no `- Required workers:` block; the run is executed entirely by the Okstra lead.

package/runtime/prompts/profiles/requirements-discovery.md

@@ -25,6 +25,13 @@
   - classify the work as bugfix, feature, improvement, refactor, or ops
   - determine whether `error-analysis` or `implementation-planning` is the next safe step. Direct `implementation` handoff is never a valid routing target — implementation requires an approved `implementation-planning` report
   - capture the reporter's **rejection criteria** — the delivered outcome that would make this work wrong or unacceptable — as a routing input. Consume it from the brief's `Desired Outcome` / `Out of Scope` / `Source Material` when present; when it is absent AND it would change the classification (e.g. bugfix vs feature) or the next-phase choice, raise it as one `decision` clarification row with `Evidence checked: none — reporter intent`. Never infer it — this is a reporter-intent signal, the mirror of improvement-discovery's `Anti-goals`
+  - record the rejection criteria in `requirementsDiscovery.rejectionCriteria` with the
+    `source` that produced it. When it was absent and would not have changed the
+    classification or the routing, say so with `source: absent-not-material` — an empty
+    field cannot be told apart from a phase that never looked
+  - record the terminology this phase settled in `requirementsDiscovery.domainAlignment`:
+    whether the glossary and decision records were read, and for every fuzzy or overloaded
+    term, the single canonical form and what decided it
   - identify missing materials that block reliable routing
   - define task continuity expectations for long-running work under the same task key
   - capture approval or confirmation points before the next phase starts

package/runtime/python/okstra_ctl/report_html/common.py

@@ -1,64 +1,75 @@
 """Common data transformations that carry no task-specific section order."""
 from __future__ import annotations
 
-
-def audit_context(data: dict) -> dict[str, object]:
+import re
+
+
+# Every block whose rows prose cites but no section of its own renders, with
+# the keys each one names its content and its provenance by. A key hunt across
+# all of them would misread `crossVerification.consensus`, whose `evidence` key
+# holds provenance while `evidence.primary` uses the same word for content —
+# so the block a row came from is named here rather than guessed.
+_LEDGER_BLOCKS = (
+    (("evidence", "primary"), "evidence", "source", "unclassified"),
+    (("evidence", "secondary"), "hypothesis", "confidence", "hypothesis"),
+    (("analysisCommon", "confirmedFacts"), "statement", "", "confirmed fact"),
+    (("analysisCommon", "inferences"), "statement", "confidence", "inference"),
+    (("analysisCommon", "unknowns"), "question", "reason", "unknown"),
+    (("crossVerification", "consensus"), "statement", "evidence", "cross-check consensus"),
+    (("crossVerification", "differences"), "disagreement", "workersPosition", "cross-check dissent"),
+    (("missingInformation",), "item", "risk", "missing information"),
+    (("endStateCoverage",), "coveredBy", "evidence", "exit contract"),
+    (("followUpTasks",), "title", "reason", "follow-up"),
+)
+
+
+def _dig(data: dict, path: tuple[str, ...]) -> list:
+    node: object = data
+    for key in path:
+        if not isinstance(node, dict):
+            return []
+        node = node.get(key)
+    return node if isinstance(node, list) else []
+
+
+def _ledger_row(row: dict, text_key: str, source_key: str, kind: str) -> dict[str, object]:
     return {
-        "crossVerification": data.get("crossVerification", {}),
-        "executionStatus": data.get("executionStatus", []),
-        "tokenUsage": data.get("tokenUsage", {}),
+        "id": row.get("id", ""),
+        "kind": kind,
+        "text": str(row.get(text_key) or ""),
+        "codeEvidence": row.get("currentCodeEvidence") or [],
+        "source": str(row.get(source_key) or "") if source_key else "",
     }
 
 
-_LEDGER_TEXT_KEYS = ("statement", "evidence", "hypothesis", "question")
-_LEDGER_SOURCE_KEYS = ("source", "confidence", "reason")
-
-
-def _first_filled(row: dict, keys: tuple[str, ...]) -> str:
-    for key in keys:
-        value = row.get(key)
-        if value:
-            return str(value)
-    return ""
-
-
-def _ledger_row(row: dict) -> dict[str, object]:
-    """Flatten one evidence row into the single shape the ledger renders.
+def _own_section_ids(data: dict) -> set[str]:
+    """Ids a section of the report already renders and anchors.
 
-    Every row type that reaches the ledger is ``additionalProperties: false``
-    and names its content and source differently, so no row carries another
-    row type's keys:
-
-    - ``evidence.primary`` — ``evidence`` / ``source``
-    - ``evidence.secondary`` — ``hypothesis`` / ``confidence``
-    - ``analysisCommon.confirmedFacts`` — ``statement`` / ``currentCodeEvidence``
-    - ``analysisCommon.inferences`` — ``statement`` / ``confidence``
-    - ``analysisCommon.unknowns`` — ``question`` / ``reason``
-
-    Only this function knows which block a row came from, so the key hunt
-    belongs here rather than in the template.
+    The ledger is the fallback home for a cited row, so it must not claim an id
+    that has one — two elements with the same anchor send half the links to the
+    wrong place. `crossVerification.consensus` numbers its rows `C-001` in some
+    runs, exactly where a clarification lives.
     """
-    return {
-        "id": row.get("id", ""),
-        "text": _first_filled(row, _LEDGER_TEXT_KEYS),
-        "codeEvidence": row.get("currentCodeEvidence") or [],
-        "source": _first_filled(row, _LEDGER_SOURCE_KEYS),
-    }
+    from ..report_contract import TASK_TYPE_DATA_PROPERTY
+
+    found: set[str] = set()
+    _collect_ids(data.get("clarificationItems", []), found)
+    property_name = TASK_TYPE_DATA_PROPERTY.get(data.get("header", {}).get("taskType", ""))
+    if property_name:
+        _collect_ids(data.get(property_name, {}), found)
+    return found
 
 
 def evidence_index(data: dict) -> dict[str, object]:
+    owned = _own_section_ids(data)
     rows: dict[str, object] = {}
-    for section in ("primary", "secondary"):
-        for row in data.get("evidence", {}).get(section, []):
-            row_id = row.get("id")
-            if row_id:
-                rows[row_id] = _ledger_row(row)
-    analysis = data.get("analysisCommon", {})
-    for collection in ("confirmedFacts", "inferences", "unknowns"):
-        for row in analysis.get(collection, []):
+    for path, text_key, source_key, kind in _LEDGER_BLOCKS:
+        for row in _dig(data, path):
+            if not isinstance(row, dict):
+                continue
             row_id = row.get("id")
-            if row_id:
-                rows[row_id] = _ledger_row(row)
+            if row_id and row_id not in owned and row_id not in rows:
+                rows[row_id] = _ledger_row(row, text_key, source_key, kind)
     return rows
 
 
@@ -74,6 +85,25 @@ def _collect_ids(value: object, found: set[str]) -> None:
             _collect_ids(nested, found)
 
 
+_ROW_ID = re.compile(r"[A-Z]{1,3}-\d+")
+
+
+def anchor_index(data: dict) -> dict[str, str]:
+    """Map every row a reader can reach to the anchor name that lands on it.
+
+    Prose cites ids across section boundaries — a hotspot names a
+    cross-verification finding, a quality row names a difference — so the
+    target set spans the whole reader-facing report: the task's own sections,
+    the clarifications, and every block the ledger takes in.
+
+    It stops there. `summary` is the AI-facing digest and
+    `analysisCommon.scope` describes the analysis target rather than listing
+    rows; neither renders, so a link to one would land nowhere.
+    """
+    found = _own_section_ids(data) | set(evidence_index(data))
+    return {row_id: f"id-{row_id}" for row_id in sorted(found) if _ROW_ID.fullmatch(row_id)}
+
+
 def analysis_review_ids(data: dict) -> tuple[str, ...]:
     found: set[str] = set()
     _collect_ids(data.get("analysisCommon", {}), found)

package/runtime/python/okstra_ctl/report_html/filters.py

@@ -1,8 +1,6 @@
 """Jinja filters for the task-specific HTML report."""
 from __future__ import annotations
 
-import html
-import json
 import re
 
 import okstra_vendor  # noqa: F401  # registers vendored dependency aliases
@@ -11,35 +9,43 @@ from markupsafe import Markup, escape
 _INLINE_CODE = re.compile(r"`([^`]+)`")
 _SENTENCE_END = re.compile(r"(?<=[.!?])\s+")
 _SENTENCES_PER_PARAGRAPH = 2
+_ID_TOKEN = re.compile(r"\b[A-Z]{1,3}-\d+\b")
 
 
-def audit_json(value: object) -> Markup:
-    """Serialize an audit payload for reading inside a ``<pre>`` text node.
+def _link_ids(escaped: str, anchors: dict) -> str:
+    """Anchor the row ids inside text that is already escaped.
 
-    Jinja's ``tojson`` guards a ``<script>`` context, so it escapes quotes and
-    angle brackets as ``\\uXXXX`` and leaves shell commands and non-ASCII
-    evidence unreadable. A text node only needs ``&``, ``<`` and ``>`` escaped,
-    hence ``quote=False`` — quotes carry no meaning outside an attribute value.
+    Running after the escape keeps this anchor the only markup in the result.
+    Only ids the document defines become links — an id with no row would point
+    at a missing anchor, and a ticket number like ``DEV-10339`` has the same
+    shape as a row id without being one.
     """
-    rendered = json.dumps(value, indent=2, ensure_ascii=False, sort_keys=True)
-    return Markup(html.escape(rendered, quote=False))
+    if not anchors:
+        return escaped
 
+    def swap(match: re.Match) -> str:
+        name = anchors.get(match.group(0))
+        return f'<a href="#{name}">{match.group(0)}</a>' if name else match.group(0)
 
-def inline_code(value: object) -> Markup:
+    return _ID_TOKEN.sub(swap, escaped)
+
+
+def inline_code(value: object, anchors: dict | None = None) -> Markup:
     """Convert paired backticks to ``<code>``, escaping everything else.
 
     Workers author report prose with Markdown conventions, so an identifier
-    arrives wrapped in backticks. ``escape`` also covers quotes, unlike
-    ``audit_json`` above, which is text-node only.
+    arrives wrapped in backticks. ``anchors`` links the row ids cited in the
+    prose, inside backticks and out.
     """
+    index = anchors or {}
     text = "" if value is None else str(value)
     out: list[str] = []
     cursor = 0
     for match in _INLINE_CODE.finditer(text):
-        out.append(str(escape(text[cursor:match.start()])))
-        out.append(f"<code>{escape(match.group(1))}</code>")
+        out.append(_link_ids(str(escape(text[cursor:match.start()])), index))
+        out.append(f"<code>{_link_ids(str(escape(match.group(1))), index)}</code>")
         cursor = match.end()
-    out.append(str(escape(text[cursor:])))
+    out.append(_link_ids(str(escape(text[cursor:])), index))
     return Markup("".join(out))
 
 
@@ -56,7 +62,7 @@ def _grouped_paragraphs(text: str) -> list[str]:
     ]
 
 
-def paragraphs(value: object) -> Markup:
+def paragraphs(value: object, anchors: dict | None = None) -> Markup:
     """Split prose into ``<p>`` blocks, converting inline code inside each.
 
     ``userNarrative`` prose arrives as one unbroken run of sentences, so the
@@ -64,30 +70,119 @@ def paragraphs(value: object) -> Markup:
     did supply blank lines keeps their own boundaries.
     """
     text = "" if value is None else str(value)
-    return Markup("".join(f"<p>{inline_code(block)}</p>" for block in _grouped_paragraphs(text)))
+    return Markup(
+        "".join(f"<p>{inline_code(block, anchors)}</p>" for block in _grouped_paragraphs(text))
+    )
 
 
-def evidence_refs(refs: object, index: object) -> Markup:
-    """Render evidence ids as anchors when the ledger defines them.
+def evidence_refs(refs: object, anchors: object) -> Markup:
+    """Render a citation list, anchoring the entries the document defines.
 
-    A citation whose id has no ledger row would link to a missing anchor, so it
-    stays text. No schema behind this filter constrains that text to an id —
-    most of it is prose citing a ``path:line``, so it takes ``inline_code`` like
-    every other prose cell. An anchor's own text is the id it links to and gets
-    no ``<code>`` wrapper.
+    The same index the prose links against decides here too — a citation and a
+    mid-sentence mention of the same id must land in the same place. No schema
+    behind this filter constrains an entry to an id: most of it is prose citing
+    a ``path:line``, which takes ``inline_code`` like every other prose cell.
     """
-    rows = index if isinstance(index, dict) else {}
+    index = anchors if isinstance(anchors, dict) else {}
     items = refs if isinstance(refs, (list, tuple)) else []
     out: list[str] = []
     for ref in items:
-        if str(ref) not in rows:
-            out.append(str(inline_code(ref)))
+        name = index.get(str(ref))
+        if name is None:
+            out.append(str(inline_code(ref, index)))
             continue
-        text = escape(str(ref))
-        out.append(f'<a href="#ev-{text}">{text}</a>')
+        out.append(f'<a href="#{name}">{escape(str(ref))}</a>')
     return Markup(", ".join(out))
 
 
+# Schema enums a reader has to decode. Each vocabulary is named so a value can
+# mean different things in different fields without one table flattening them.
+# A value with no entry renders as itself — a new enum member shows up raw
+# rather than silently reading as something it is not.
+ENUM_LABELS: dict[str, dict[str, str]] = {
+    "coverage": {
+        "covered": "A break fails a test",
+        "partial": "Partly covered",
+        "gap": "No test",
+        "risk": "Passes without proving",
+    },
+    "effort": {"S": "Small", "M": "Medium", "L": "Large", "XL": "Very large"},
+    "versionSource": {
+        "manifest-range": "Manifest range",
+        "lockfile-pinned": "Lockfile pin",
+        "container-image": "Container image",
+        "runtime-config": "Runtime config",
+        "declared-doc": "Declared in docs",
+    },
+    "interfaceKind": {
+        "port": "Port",
+        "adapter": "Adapter",
+        "service-api": "Service API",
+        "module-export": "Module export",
+        "event": "Event",
+    },
+    "toolKind": {
+        "packageManager": "Package manager",
+        "build": "Build",
+        "test": "Test",
+        "lint": "Lint",
+        "typecheck": "Type check",
+        "format": "Format",
+        "ci": "CI",
+        "container": "Container",
+    },
+    "lens": {"candidate-found": "Candidate found", "no-candidate": "Nothing found"},
+    "rejectionSource": {
+        "brief-desired-outcome": "Brief · desired outcome",
+        "brief-out-of-scope": "Brief · out of scope",
+        "brief-source-material": "Brief · source material",
+        "clarification-raised": "Raised as a question",
+        "absent-not-material": "Absent · does not change the call",
+    },
+    "termSource": {
+        "glossary": "Glossary",
+        "decision-record": "Decision record",
+        "brief": "Brief",
+        "clarification": "Your answer",
+    },
+    "handoffMode": {"whole-task": "Whole task", "stage-group": "Selected stages"},
+}
+
+
+# What each member of a vocabulary actually claims. A two-word label fits a
+# table cell but cannot carry a definition, and a reader meeting "Passes
+# without proving" for the first time has nowhere to look it up. Only
+# vocabularies whose members are judgements need one; a kind names itself.
+ENUM_HINTS: dict[str, dict[str, str]] = {
+    "coverage": {
+        "covered": "Break this area and a test fails.",
+        "partial": "Tests exist, but part of the area runs through none of them.",
+        "gap": "No test runs through this area at all.",
+        "risk": (
+            "Tests run and pass, but they skip or assert nothing, so passing "
+            "is not evidence that the area works. More dangerous than "
+            "'No test', because the suite reports success."
+        ),
+    },
+}
+
+
+def enum_label(value: object, vocabulary: str) -> str:
+    """Render a schema enum as the words it stands for."""
+    raw = "" if value is None else str(value)
+    return ENUM_LABELS.get(vocabulary, {}).get(raw, raw)
+
+
+def enum_legend(vocabulary: str) -> list[tuple[str, str]]:
+    """Pair each label with what it claims, for a legend beside the table.
+
+    Built from the same two tables the cells render from, so a legend cannot
+    drift from the labels it explains.
+    """
+    labels = ENUM_LABELS.get(vocabulary, {})
+    return [(labels.get(value, value), hint) for value, hint in ENUM_HINTS.get(vocabulary, {}).items()]
+
+
 def code_evidence(rows: object) -> Markup:
     """Render ``currentCodeEvidence`` entries as ``path:line`` code spans."""
     items = rows if isinstance(rows, (list, tuple)) else []

package/runtime/python/okstra_ctl/report_html/models.py

@@ -11,15 +11,30 @@ class HtmlRunMeta:
     task_type: str
     seq: str
     source_report: str
+    # Wall-clock milliseconds for the run, or None when the team-state
+    # carried no timestamps to measure between.
+    elapsed_ms: int | None = None
 
 
 @dataclass(frozen=True)
 class VisualNode:
     id: str
     label: str
+    # Which column the figure puts this node in, and which fill it draws it
+    # with. Both are drawing instructions: `group` is often a path prefix and
+    # `status` is often a constant. The text table printed them raw under the
+    # headings "group" and "status", so in a single-root project every
+    # component read "src · stable" — a layout key and a literal, neither a
+    # fact about the project. Anything the reader should see goes in `note`.
     group: str
     status: str
     detail: str
+    # Files the node stands for. The figure's text alternative is the only
+    # place a reader can look them up, so they travel with the node.
+    paths: tuple[str, ...] = ()
+    # What this node is, in the reader's words. Empty when the figure has
+    # nothing to say beyond the label.
+    note: str = ""
 
 
 @dataclass(frozen=True)

package/runtime/python/okstra_ctl/report_html/render.py

@@ -10,7 +10,15 @@ from jinja2 import Environment, FileSystemLoader, StrictUndefined, select_autoes
 
 from ..final_report_schema import load_schema_for_data, validate
 from ..report_view_artifacts import user_responses_dir_for_report
-from .filters import audit_json, code_evidence, evidence_refs, inline_code, paragraphs
+from .common import anchor_index
+from .filters import (
+    code_evidence,
+    enum_label,
+    enum_legend,
+    evidence_refs,
+    inline_code,
+    paragraphs,
+)
 from .models import HtmlRunMeta
 from .router import HtmlRenderError, resolve_html_route
 
@@ -30,6 +38,32 @@ def _templates_root(start: Path | None = None) -> Path:
     raise HtmlRenderError("could not locate templates/reports")
 
 
+def _elapsed_text(elapsed_ms: int | None) -> str | None:
+    """Render a run duration, or nothing when there is none to render.
+
+    A run whose team-state never recorded timestamps has no measured duration;
+    printing "0m" would claim it finished instantly.
+    """
+    if not elapsed_ms or elapsed_ms < 0:
+        return None
+    minutes, seconds = divmod(round(elapsed_ms / 1000), 60)
+    hours, minutes = divmod(minutes, 60)
+    if hours:
+        return f"{hours}h {minutes}m"
+    if minutes:
+        return f"{minutes}m {seconds}s"
+    return f"{seconds}s"
+
+
+def _report_meta(data: dict, run_meta: HtmlRunMeta) -> dict[str, object]:
+    return {
+        "createdAt": data.get("header", {}).get("createdAt", ""),
+        "taskTitle": data.get("frontmatter", {}).get("title", ""),
+        "taskKey": run_meta.task_key,
+        "elapsed": _elapsed_text(run_meta.elapsed_ms),
+    }
+
+
 def _html_path(data_path: Path) -> Path:
     suffix = ".data.json"
     if not data_path.name.endswith(suffix):
@@ -55,16 +89,21 @@ def render_v2_html_view(
     root = _templates_root(templates_root)
     env = Environment(loader=FileSystemLoader(str(root)), autoescape=select_autoescape(("html",)), undefined=StrictUndefined)
     env.policies["json.dumps_kwargs"] = {"sort_keys": True, "ensure_ascii": False}
-    env.filters["audit_json"] = audit_json
+    # Binding the index here is what lets a template cite an id without
+    # threading the index through every macro and call site.
+    anchors = anchor_index(data)
     env.filters["code_evidence"] = code_evidence
-    env.filters["evidence_refs"] = evidence_refs
-    env.filters["inline_code"] = inline_code
-    env.filters["paragraphs"] = paragraphs
+    env.filters["enum_label"] = enum_label
+    env.filters["enum_legend"] = enum_legend
+    env.filters["evidence_refs"] = lambda refs: evidence_refs(refs, anchors)
+    env.filters["inline_code"] = lambda value: inline_code(value, anchors)
+    env.filters["paragraphs"] = lambda value: paragraphs(value, anchors)
     response_js = (root / "report.js").read_text(encoding="utf-8")
     base_js = (root / "html/assets/base.js").read_text(encoding="utf-8")
     context = {
         **view.context,
         "runMeta": run_meta,
+        "reportMeta": _report_meta(data, run_meta),
         "taskType": view.task_type,
         "dataSha256": _sha256(data_path),
         "markdownSha256": _sha256(markdown_path),

package/runtime/python/okstra_ctl/report_html/view_models/change_impact_analysis.py

@@ -1,20 +1,31 @@
 """Human-first change-impact-analysis view model."""
 from __future__ import annotations
 
-from ..common import analysis_review_ids, audit_context, evidence_index
+from ..common import analysis_review_ids, evidence_index
 from ..models import HumanReportView, VisualEdge, VisualNode
 from ..visualizations import flow_figure
 
 
 def _impact_figure(change: dict):
     nodes = [
-        VisualNode(row["id"], row["target"], "affected", row["level"], row["impactKind"])
+        VisualNode(
+            row["id"],
+            row["target"],
+            "affected",
+            row["level"],
+            row["impactKind"],
+            note=f'Impact {row["level"]}',
+        )
         for row in change.get("impactItems", [])
     ]
     edges: list[VisualEdge] = []
     for index, row in enumerate(change.get("dependencyBlastRadius", []), start=1):
         target_id = f"BR-{index:03d}"
-        nodes.append(VisualNode(target_id, row["affectedTarget"], "downstream", "risk", row["direction"]))
+        nodes.append(
+            VisualNode(
+                target_id, row["affectedTarget"], "downstream", "risk", row["direction"], note="Downstream"
+            )
+        )
         edges.append(VisualEdge(row["sourceImpactId"], target_id, row["direction"], "impact"))
     return flow_figure(nodes=tuple(nodes), edges=tuple(edges), title="Change blast radius")
 
@@ -29,7 +40,6 @@ def build_change_impact_analysis_view(data: dict) -> HumanReportView:
         "blastRadiusFigure": figure,
         "analysisReviewIds": analysis_review_ids(data),
         "evidenceIndex": evidence_index(data),
-        "audit": audit_context(data),
     }
     return HumanReportView(
         task_type="change-impact-analysis",

package/runtime/python/okstra_ctl/report_html/view_models/error_analysis.py

@@ -1,14 +1,14 @@
 """Human-first error-analysis view model."""
 from __future__ import annotations
 
-from ..common import audit_context, evidence_index
+from ..common import evidence_index
 from ..models import HumanReportView, VisualEdge, VisualNode
 from ..visualizations import cause_graph_figure
 
 
 def _cause_figure(error: dict):
     symptom = VisualNode(
-        "symptom", "Observed failure", "effect", "risk", error["observableFailure"]
+        "symptom", "Observed failure", "effect", "risk", error["observableFailure"], note="Observed failure"
     )
     causes = tuple(
         VisualNode(
@@ -17,6 +17,7 @@ def _cause_figure(error: dict):
             "candidate",
             row["confidence"],
             row["disproveWith"],
+            note=f'Confidence {row["confidence"]}',
         )
         for row in error.get("causeCandidates", [])
     )
@@ -39,7 +40,6 @@ def build_error_analysis_view(data: dict) -> HumanReportView:
         "narrative": error["userNarrative"],
         "causeFigure": figure,
         "evidenceIndex": evidence_index(data),
-        "audit": audit_context(data),
     }
     return HumanReportView(
         "error-analysis",