software-defence-factory 0.11.2 → 0.13.0

package/{operator-skills → .agents/skills}/factory-foundation/SKILL.md

@@ -10,7 +10,7 @@ instructions, existing source and session decisions. Preserve useful work and
 licenses. Assessment-only requests stay read-only. A method-only adoption needs
 no runtime, Docker host or model account.
 
-The [setup plan](../../docs/setup.md) owns supported commands and checkpoints.
+The [setup plan](../../../docs/setup.md) owns supported commands and checkpoints.
 Read the relevant sections rather than inventing a host-specific setup recipe.
 Choose this skill explicitly when adopting Factory. Project preparation tools
 need no knowledge of Factory and do not invoke this transition automatically.
@@ -24,7 +24,7 @@ Use the actual host's OS, service manager, hardware and private network; do not
 assume a machine model, a VPN provider, a cloud, Git forge, issue tracker, CI
 provider or particular harness. Inspect the configured remote and actual provider
 capabilities. GitHub is one adapter; an unsupported host keeps local execution
-without guessed API calls. Use [integration ownership](../../docs/integrations.md).
+without guessed API calls. Use [integration ownership](../../../docs/integrations.md).
 
 Use the existing task/issue record for missing obligations and evidence. Avoid a
 second project registry or a template conversion of an existing application.
@@ -38,9 +38,9 @@ Continue authorized repairs; ask only for decisions or authority actually missin
   repository instructions. Adapt the staged method to the
   project; do not overwrite its files. Reconcile the chosen provider’s issue forms/labels (where supported), CI triggers,
   required checks, protection rules and the intended PR/release path using
-  [repository readiness](../../kit/repository.md). Before trusted GitHub PR
+  [repository readiness](../../../kit/repository.md). Before trusted GitHub PR
   delivery, confirm active candidate-triggered workflows fit the bounded
-  qualification in [recovery](../../docs/recovery.md#trusted-pr-delivery);
+  qualification in [recovery](../../../docs/recovery.md#trusted-pr-delivery);
   unsupported workflows keep delivery patch-only. Organization hooks and
   external CI remain operator-owned. File presence is not proof.
 - **Infrastructure:** choose a private state directory, loopback port, host and

package/README.md

@@ -39,13 +39,16 @@ The runtime supplies policy and six focused skills to its isolated jobs. `init`
 
 ## How the factory works
 
-[![Factory setup, execution and delivery](https://raw.githubusercontent.com/arcitai/software-and-defence-factory/main/docs/architecture.svg)](https://github.com/arcitai/software-and-defence-factory/blob/main/docs/architecture.excalidraw)
+<a href="docs/architecture.md"><img src="docs/diagrams/deployment.svg" width="720" alt="Factory setup: operator access to a private execution host with Docker, a chosen harness and inference; application deployment remains in its own CI/CD."></a>
 
-[Architecture and boundaries](docs/architecture.md) · [Editable Excalidraw source](https://github.com/arcitai/software-and-defence-factory/blob/main/docs/architecture.excalidraw)
+[Architecture and boundaries](docs/architecture.md). Editable views:
+[Setup / deployment](docs/diagrams/deployment.excalidraw) ·
+[Runtime layers / ownership](docs/diagrams/architecture.excalidraw) ·
+[Work lifecycle](docs/diagrams/lifecycle.excalidraw)
 
 Each result belongs to a specific candidate commit and policy. A failed check blocks delivery. Changing the candidate or check policy invalidates earlier evidence. Approval records a handoff; publishing, merging and deployment follow the application's separate authority.
 
-The project dashboard has an **Inbox**, measured **Analytics**, **Agents**, **Skills**, **Automations**, **Definition** and **Infrastructure**. Inbox lists repository issues with readiness and linked execution attempts. New issue offers repository templates or a blank creation form. Create an issue on the supported repository provider, then choose Start work separately; local brief execution remains available. CLI `issue` exposes the same intake. Definition lives with settings above the theme control. The CLI reads the same definition and controller state. Agent roles use a selected harness such as Codex or Pi; a worker executes their isolated jobs on a host. See [concepts](docs/concepts.md) and [supported interfaces](docs/interfaces.md). Optional automations belong to the selected harness, which calls Factory CLI/API. Factory runs no cron scheduler. See [provider boundaries](docs/integrations.md).
+The project dashboard has an **Inbox**, measured **Analytics**, **Agents**, **Skills**, **Automations**, **Definition** and **Infrastructure**. Inbox opens on a shared list/board of loaded repository issues and local work, with status, search and checkbox filters, readiness and linked execution attempts. New issue offers repository templates or a blank creation form. Create an issue on the supported repository provider, then choose Start work separately; local brief execution remains available. CLI `issue` exposes the same intake. Definition lives with settings above the theme control. The CLI reads the same definition and controller state. Agent roles use a selected harness such as Codex or Pi; a worker executes their isolated jobs on a host. See [concepts](docs/concepts.md) and [supported interfaces](docs/interfaces.md). Optional automations belong to the selected harness, which calls Factory CLI/API. Factory runs no cron scheduler. See [provider boundaries](docs/integrations.md).
 
 The optional **defence** workflow accepts scoped incident evidence and produces a private, read-only draft. It does not monitor production or claim verified recovery. See [defence integration](docs/defence-integration.md).
 
@@ -58,8 +61,8 @@ Start setup with `factory foundation` and the [Factory Foundation plan](docs/set
 | `bin/` | CLI entry point |
 | `factory/` | Queue, HTTP API, isolation, evidence, updates and bundled dashboard assets |
 | `dashboard/` | Dashboard source and UI tests |
-| `kit/`, `.agents/skills/` | Portable method, adoption records and six job skills |
-| `operator-skills/` | Factory Foundation setup guidance; never mounted into jobs |
+| `kit/`, `kit/skills/` | Portable method, adoption records and the canonical six job skills |
+| `.agents/skills/` | Repository/operator guidance, including explicit Factory Foundation adoption; outside the job catalog |
 | `scripts/`, `tests/` | Packaging, qualification, release checks and behavioral tests |
 | `docs/` | Setup, architecture, recovery, proof and ownership |
 

package/docs/concepts.md

@@ -18,8 +18,10 @@ The CLI `definition` command and dashboard Definition page read that same catalo
 | Automation | External schedule and agent context | Owned by the selected harness; calls Factory CLI/API, no Factory cron |
 | Definition | Effective roles, workflows, skills and settings | Installed method plus private factory.json; read-only catalog |
 
-Inbox contains execution history, not a copied remote issue backlog. New issue
-can create a repository issue without execution; Start work admits execution
+Inbox combines an explicitly loaded provider page with retained execution
+history in one list/board, grouped by canonical issue identity. Off-page sources
+remain unknown; local requests keep separate identities. New issue
+creates a repository issue without execution; Start work admits execution
 separately. The provider owns issue content/state; SQLite owns queue/attempts and
 creation receipts for recovery. An unfinished local form is not a saved backlog.
 An agent role is neither a machine nor a skill. Check is deterministic, and

package/docs/interfaces.md

@@ -11,7 +11,7 @@ shell endpoint or a second scheduler.
 | --- | --- | --- | --- | --- |
 | Project/queue/attempt state | `status`, `inbox --source factory` JSON | `GET /api/v1/status` | Project, tasks, details/history | Stable versioned agent result/error contract |
 | Start local work | `issue start --file --title` or `--draft`, explicit `--workflow`, optional `--model` | `POST /api/v1/jobs` | Local execution only → review → Create & start locally | Persistent unstarted drafts and typed incident intake remain separate |
-| Browse repository Inbox | `inbox [--page N] [--issue-state open/closed/all]` (also `issue list --source inbox`), `issue preview --url URL` via controller provider | Authenticated `GET /api/v1/issues`, `POST /api/v1/issues/preview` using shared readers | Inbox with provider/state/readiness, loaded-page counts, linked attempts, local/off-page history; explicit Start work for either type | Issue → execution links retained; no implicit polling |
+| Browse repository Inbox | `inbox [--page N] [--issue-state open/closed/all]` (also `issue list --source inbox`), `issue preview --url URL` via controller provider | Authenticated `GET /api/v1/issues`, `POST /api/v1/issues/preview` using shared readers | Primary list/Board with shared status/search/workflow/model/label filters, compact Repository tools/loaded scope, item count with secondary issue/execution totals and progressive linked detail; explicit Start work for either type | Issue → execution links retained; no implicit polling |
 | Start repository work | `issue start --url URL --workflow software/defence [--brief-file operator.md]` | `POST /api/v1/issues/start` | Issue context → explicit Start work with operator brief | Rechecks current content and active admission |
 | Create repository issue / recovery | `issue connection`, `create --key`, `submissions`, `recover --key` | Authenticated connection, `POST /issues`, receipts and recovery | Display destination/actor, create without execution, recover uncertain result | GitHub adapter first; assignees/projects and other providers unimplemented |
 | Repository issue templates | `issue templates`, `issue draft --template --sha --file` | Authenticated template list and draft compilation | Chooser, fields/defaults/validation, review | Supports Markdown and YAML markdown/input/textarea/dropdown/checkboxes; unsupported templates link to GitHub |
@@ -106,3 +106,25 @@ Definition exposes `configuration.issueReadinessLabels`. The optional private
 config field has exactly triage/spec/ready/blocked keys with four distinct label
 names; defaults are factory:triage/spec/ready/blocked. Configuration is validated,
 not inferred from issue content. No browsing path changes labels or comments.
+
+The additive `work_records` read model is returned by `GET /api/v1/issues`
+(and CLI `inbox` / `issue list --source inbox`) alongside the existing `issues`
+and `history` fields. `status` returns the same model for retained history without
+fetching a provider page. Each record includes a canonical `key`, source `identity`,
+`source_status` (`loaded`, `not_loaded`, `local`), optional source `issue`, all
+`executions`, representative `execution_id`, actual `state`, `workflow` and `phase`.
+Active/unresolved execution takes precedence over the latest terminal execution.
+Without an execution, state is `not_started`, workflow/phase and execution ID are
+null. Readiness lives on the source issue, separate from execution state. Dashboard
+projection uses this same pure read-model function with its bounded page snapshot
+and latest status; grouping/filtering does not admit execution. Individual
+`#/runs/JOB_ID` links remain valid; `#/issues/KEY` opens canonical source detail.
+
+The dashboard's Repository disclosure beside the item count holds source-state
+selection, refresh, available previous/next page actions and Local execution
+request. It also explains read time, remote total, the loaded search boundary
+and separate issue/local request/execution counts. Loading and source errors
+remain visible when it is closed. Rows and cards share compact metadata; source
+readiness remains distinct from the runtime badge, and full assignments and
+linked attempts remain in detail. These presentation controls do not change
+headless records or admission semantics.

package/docs/npm.md

@@ -104,8 +104,8 @@ installation or retained attempt needs them.
 
 ## Protected evidence compatibility
 
-Factory 0.11.2 recognizes version-1 execution profiles emitted by native
-**0.8.0, 0.9.0, 0.9.1, 0.10.0, 0.11.0, 0.11.1 and 0.11.2**. This is an exact allowlist in
+Factory 0.13.0 recognizes version-1 execution profiles emitted by native
+**0.8.0, 0.9.0, 0.9.1, 0.10.0, 0.11.0, 0.11.1, 0.11.2, 0.12.0 and 0.13.0**. This is an exact allowlist in
 `factory/execution-profile.mjs`, independent of the installed package version;
 it is not a semver range or an automatic promise for later releases. Unknown
 runtime strings, unknown profile formats and incomplete legacy acceptance
@@ -149,6 +149,24 @@ new acceptance. Older writers remain compatible only when their retained patch
 passes the current digest and tree reconstruction checks. A digest-matching
 malformed patch remains blocked and unchanged; follow the [recovery guidance](recovery.md#already-accepted-malformed-patches-91).
 
+Version 0.12.0 adds the all-work Inbox read model and restores the retained
+overview. Protected execution writers and acceptance/publication guards are
+unchanged; the explicit compatible-writer entry preserves all checks above.
+
+Version 0.13.0 relocates byte-identical runtime skill instructions to
+`kit/skills/` and adds a read-only alias of that catalog for Codex discovery.
+The audit covers `execution-profile.mjs`, `processes.mjs`, executor candidate,
+check, review and acceptance writers, `execution-evidence.mjs` and both delivery
+capability/validation paths. The v1 schema, candidate reconstruction, current
+policy checks, isolation and model credential rules are unchanged. Foundation
+is outside the job catalog. Supported old immutable evidence remains subject
+to every existing guard; unknown later versions receive no automatic trust.
+
+Old installed releases retain their own files and mount paths until an idle,
+reviewed update. No installed catalog, execution profile or historical hash is
+rewritten by this layout change. Qualify the exact updated package/image before
+resuming work; retained releases/evidence stay available for recovery.
+
 New publication still requires the current remote target to equal the original
 accepted base; reviewed-candidate continuation preserves that baseline, while
 target refresh remains #72. See [the verification map](https://github.com/arcitai/software-and-defence-factory/blob/main/docs/proof.md) for delivered

package/docs/setup.md

@@ -1,7 +1,13 @@
 # Factory Foundation: repository and execution setup
 
-The operator skill is available through `factory foundation`.
+The operator skill is available through `factory foundation`, including from
+an installed npm package without a source checkout. Its canonical source is
+[.agents/skills/factory-foundation/SKILL.md](../.agents/skills/factory-foundation/SKILL.md).
+Use it explicitly for adoption; it is independent of AIOS. Repository/operator
+guidance stays outside the runtime catalog at `kit/skills/`.
 See [Factory concepts](concepts.md) for host, worker, harness and agent roles.
+The [setup/deployment view](architecture.md#setup-and-deployment) shows operator
+access, the private execution host and the separate application delivery boundary.
 
 Use this plan for a new installation or when moving an existing Factory to an
 execution host. Complete the applicable checkpoints in order and record the
@@ -36,7 +42,19 @@ this plan.
 
 For method-only adoption, run `factory kit --output NEW_DIRECTORY`
 and follow [the adoption guide](../kit/README.md). The remaining host/runtime
-steps apply only when using Factory's optional controller.
+steps apply only when using Factory's optional controller. Export maps the six
+job skills into staged `.agents/skills/`; it never changes the application's
+AGENTS.md or installs global skills. Foundation stays in the installed package.
+
+Runtime jobs receive only the reviewed catalog as read-only `/factory-skills`.
+Codex agent phases also discover that same catalog at `/etc/codex/skills`; Pi
+uses `--skill /factory-skills`. Verify discovery on the exact installed image
+without credentials or inference (Codex native listing and Pi RPC
+`get_commands`), then qualify inference separately when authorized. Custom
+harness discovery remains operator-owned. A directory listing alone is not
+native discovery proof. Bundled instructions install no model, browser, Docker
+or provider access. Repository guidance remains readable project context and
+cannot expand job permissions.
 
 ## 2. Establish host access and boot prerequisites
 

package/docs/workflows.md

@@ -15,16 +15,22 @@ Defence currently runs **Investigate** against supplied scoped evidence and
 produces a private draft. It is not production monitoring, exploitation or
 verified recovery. See [Defence integration](defence-integration.md).
 
-The six bundled job skills cover triage, specification, implementation, review,
+The six bundled job skills in `kit/skills/` cover triage, specification, implementation, review,
 security and evaluation. They are instructions, not six running processes.
 All are mounted read-only for agent steps; the role prompt supplies the work
 boundary. Triage/specification prepare scope before admission; evaluation is a
 separately scoped comparison. Factory Foundation is an operator setup skill,
-kept outside those execution mounts.
+at `.agents/skills/factory-foundation/SKILL.md`, used explicitly for adoption
+and kept outside those execution mounts. CLI/API/Skills show actual installed
+paths, content and SHA-256. Codex additionally mounts the same runtime catalog at
+`/etc/codex/skills`; Pi uses `--skill /factory-skills`. Discovery on a particular
+image needs native qualification, and skills provide neither tools nor access.
 
 ## Start work
 
-Inbox lists repository issues directly. Choose Open, Closed or All states and use
+Inbox opens on the shared list/Board of repository issues and local work, with
+status rail and workflow/model/status/label multiselects. Never-started issues
+have unknown workflow/model and a distinct Not started state. Choose Open, Closed or All states and use
 Previous/Next page or Refresh issues. Search covers the loaded page and visible
 history, not the whole repository. GitHub returns up to 50 records per page;
 pull requests are excluded, so even a page with zero issues can have a next page.
@@ -146,4 +152,7 @@ non-issue paths are not admitted by the provider preview. Local-only records and
 executions whose source is missing, closed or outside the loaded page remain in
 Local and other execution history. Removing local execution history preserves
 private evidence and never deletes a provider issue; unresolved delivery guards
-still apply. The separate Execution history tab keeps the execution list/board.
+still apply. The primary list/board includes all these records; no separate
+Execution history tab is needed. Its count line distinguishes issue identities
+and individual executions. Open a record for progressive context and every
+linked attempt; close/Escape returns to the preserved filters, view and scroll.

package/factory/definition.mjs

@@ -24,7 +24,7 @@ const skillRoles = {
 export function factoryDefinition(config) {
   const harness = harnessOf(config);
   const skills = Object.entries(skillRoles).map(([role, purpose]) => {
-    const id = `factory-${role}`, path = `.agents/skills/${id}/SKILL.md`;
+    const id = `factory-${role}`, path = `kit/skills/${id}/SKILL.md`;
     const content = readFileSync(join(ROOT, path), 'utf8');
     return { id, purpose, path, content, sha256: digest(content) };
   });
@@ -58,7 +58,7 @@ export function factoryDefinition(config) {
 }
 
 export function foundationSkill() {
-  const path = 'operator-skills/factory-foundation/SKILL.md';
+  const path = '.agents/skills/factory-foundation/SKILL.md';
   const content = readFileSync(join(ROOT, path), 'utf8');
   return { id: 'factory-foundation', purpose: 'Prepare a repository and host for bounded Factory work', path, content, sha256: digest(content) };
 }

package/factory/execution-profile.mjs

@@ -9,12 +9,15 @@ import { expectedWebStories, webPolicyHash } from './web-verification.mjs';
 // Audited v1 protected evidence writers: 0.8.0 (380f749), 0.9.0 (cdaadef),
 // 0.9.1, 0.10.0, 0.11.0 and 0.11.1 (unchanged protected evidence writers),
 // 0.11.2 (exact patch bytes and pre-acceptance reconstruction; same v1 schema).
+// 0.12.0 restores the Inbox read model/presentation; protected writers and guards are unchanged.
+// 0.13.0 relocates identical job skills and adds a read-only Codex discovery alias.
+// Candidate/check/review/acceptance schemas, isolation and credential/permission guards are unchanged.
 // Older writers still require exact patch/tree reconstruction before publication.
 // Deliberately independent of VERSION: a release bump is not
 // evidence compatibility. Re-audit this list for every trust-relevant writer,
 // isolation or validation change; remove versions whose guarantees no longer
 // satisfy current policy. See docs/npm.md. This predicate alone grants no trust.
-const SUPPORTED_EXECUTION_RUNTIMES_V1 = new Set(['0.8.0', '0.9.0', '0.9.1', '0.10.0', '0.11.0', '0.11.1', '0.11.2']);
+const SUPPORTED_EXECUTION_RUNTIMES_V1 = new Set(['0.8.0', '0.9.0', '0.9.1', '0.10.0', '0.11.0', '0.11.1', '0.11.2', '0.12.0', '0.13.0']);
 
 export function isSupportedExecutionProfile(profile) {
   return profile?.version === 1 && SUPPORTED_EXECUTION_RUNTIMES_V1.has(profile.runtimeVersion);

package/factory/executor.mjs

@@ -91,7 +91,10 @@ async function container(mode, input, command, options = {}) {
     '--mount',`type=bind,source=${join(workspace,'.git')},target=/workspace/.git,readonly`];
   args.push('--mount',`type=bind,source=${reportDir},target=/output`,
     '--mount',`type=bind,source=${join(ROOT,'kit')},target=/factory-policy,readonly`,
-    '--mount',`type=bind,source=${join(ROOT,'.agents/skills')},target=/factory-skills,readonly`);
+    '--mount',`type=bind,source=${join(ROOT,'kit/skills')},target=/factory-skills,readonly`);
+  // The same reviewed catalog supplies Codex native discovery; no operator skills.
+  if (mode !== 'verify' && harnessOf(config) === 'codex')
+    args.push('--mount',`type=bind,source=${join(ROOT,'kit/skills')},target=/etc/codex/skills,readonly`);
   if (scratch) args.push('--mount',`type=bind,source=${scratch},target=/scratch`);
   if (mode === 'verify') args.push('--env',`FACTORY_BASE_REVISION=${git('rev-parse',`${metadata().base}^{commit}`)}`);
   const logPath = join(folder, attempt, `${mode}.log`);

package/factory/issue-intake.mjs

@@ -24,6 +24,13 @@ function issueLabels(labels = []) {
   return labels.map(label => ({name:label.name, color:/^[a-f0-9]{6}$/i.test(label.color || '') ? label.color.toLowerCase() : null}));
 }
 
+function issueMetadata(issue) {
+  const date = value => typeof value === 'string' && Number.isFinite(Date.parse(value)) ? value : null;
+  const author = issue.user?.login || issue.author?.login;
+  return { author: typeof author === 'string' ? author : null,
+    created_at: date(issue.created_at || issue.createdAt), updated_at: date(issue.updated_at || issue.updatedAt) };
+}
+
 export async function listIssues(repo, page = 1, read = githubRead, state = 'open') {
   if (!Number.isSafeInteger(page) || page < 1 || page > 10000) throw new Error('Issue page must be an integer between 1 and 10000.');
   if (!['open', 'closed', 'all'].includes(state)) throw new Error('Issue state must be open, closed or all.');
@@ -35,7 +42,7 @@ export async function listIssues(repo, page = 1, read = githubRead, state = 'ope
   const issues = result.filter(issue => !issue.pull_request).map(issue => {
     validateIssueURL(repository, issue.html_url);
     if (!Number.isSafeInteger(issue.number) || !issue.html_url.endsWith(`/issues/${issue.number}`) || typeof issue.title !== 'string' || !issue.title.trim()) throw new Error('GitHub returned an unexpected issue.');
-    return { number: issue.number, title: issue.title, url: issue.html_url, state: issue.state || 'unknown', labels: issueLabels(issue.labels) };
+    return { ...issueMetadata(issue), number: issue.number, title: issue.title, url: issue.html_url, state: issue.state || 'unknown', labels: issueLabels(issue.labels) };
   });
   return { repository, issues, next_page: result.length === 50 && page < 10000 ? page + 1 : null };
 }
@@ -46,7 +53,7 @@ export function validateIssueURL(repoURL, value) {
   if (!repoURL || identity.repository !== repoURL.toLowerCase()) throw new Error('Issue does not belong to this project’s configured GitHub origin.');
   return identity.url;
 }
-export async function readIssue(repo, url, read = url => githubRead(['issue', 'view', url, '--json', 'title,body,url,labels,state'])) {
+export async function readIssue(repo, url, read = url => githubRead(['issue', 'view', url, '--json', 'title,body,url,labels,state,author,createdAt,updatedAt'])) {
   const repoURL = readProjectLinks(repo)?.repository;
   url = validateIssueURL(repoURL, url);
   const issue = await read(url);
@@ -55,5 +62,5 @@ export async function readIssue(repo, url, read = url => githubRead(['issue', 'v
   const spec = `Issue: ${issue.url}\n${issue.title}\n\n${issue.body}`;
   if (Buffer.byteLength(spec) > 240000) throw new Error('Issue exceeds the 240 KB task limit. Use a bounded task file instead.');
   const labels = issueLabels(issue.labels);
-  return { title: issue.title, url, number: canonicalIssue(url).number, state: issue.state?.toLowerCase() || 'unknown', body: issue.body, spec, labels, recommendation: recommendWork({ spec, labels: labels.map(label => label.name) }) };
+  return { ...issueMetadata(issue), title: issue.title, url, number: canonicalIssue(url).number, state: issue.state?.toLowerCase() || 'unknown', body: issue.body, spec, labels, recommendation: recommendWork({ spec, labels: labels.map(label => label.name) }) };
 }

package/factory/issue-lifecycle.mjs

@@ -57,3 +57,28 @@ export function backlogHistory(jobs, issues) {
   }
   return [...grouped.values()];
 }
+
+// Canonical all-work read model, shared by headless readers and the dashboard.
+// A source page is a bounded snapshot, never evidence that other sources closed.
+export function workRecords(jobs = [], issues = []) {
+  const sources = new Map(issues.map(issue => [issue.identity.key, issue]));
+  const histories = backlogHistory(jobs, []);
+  const rows = new Map(histories.map(row => [row.key, row]));
+  for (const [key, issue] of sources) rows.set(key, {
+    ...issue, key, ...executionAssociation(jobs, issue.identity),
+  });
+  return [...rows.values()].map(row => {
+    const issue = sources.get(row.key) || null;
+    const execution = row.active_execution || row.latest_execution || row.executions[0] || null;
+    return {
+      key: row.key, identity: row.identity, title: issue?.title || row.title,
+      url: row.url, source_status: issue ? 'loaded' : row.identity ? 'not_loaded' : 'local',
+      issue, executions: row.executions, active_execution: row.active_execution || null,
+      latest_execution: row.latest_execution || execution,
+      execution_id: execution?.id || null,
+      state: execution?.state || 'not_started',
+      workflow: execution?.workflow || null,
+      phase: execution?.phase || null,
+    };
+  });
+}

package/factory/providers/github.mjs

@@ -38,7 +38,7 @@ export function githubIssueProvider(repo, { read = githubRead, write = githubWri
     id: 'github', label: 'GitHub', repository, supported: true,
     capabilities: { issues: true, templates: true, create: true },
     list: (page, state) => listIssues(repo, page, read, state),
-    preview: url => readIssue(repo, url, value => read(['issue', 'view', value, '--json', 'title,body,url,labels,state'])),
+    preview: url => readIssue(repo, url, value => read(['issue', 'view', value, '--json', 'title,body,url,labels,state,author,createdAt,updatedAt'])),
     templates: () => readTemplates(repo, read),
     draft: input => draftFromTemplate(repo, input, read),
     async context() {

package/factory/server.mjs

@@ -1,4 +1,4 @@
-import { associateIssue, backlogHistory, readinessMapping } from './issue-lifecycle.mjs';
+import { associateIssue, backlogHistory, readinessMapping, workRecords } from './issue-lifecycle.mjs';
 import { harnessOf } from './lib.mjs';
 import http from 'node:http';
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
@@ -88,7 +88,7 @@ export function createController(state, adapter = executors(state), integrations
           delivery_removal_blocked: Boolean(job.delivery && !['published', 'abandoned'].includes(job.delivery.state)),
           delivery_status: delivery.summary(job), runs: job.runs.map(attempt => attemptPresentation({ ...attempt,
           outcome: attempt.outcome || (attempt.state === 'succeeded' ? 'complete' : undefined) }, adapter.usage?.(job, attempt))) }));
-        return send(200, { version: 1, runtime_version: VERSION, maintenance: queue.maintenance, workflows: Object.keys(definitions.workflows), commands: [], triggers: [], jobs, issue_history: backlogHistory(jobs, []), csrf_token: csrf,
+        return send(200, { version: 1, runtime_version: VERSION, maintenance: queue.maintenance, workflows: Object.keys(definitions.workflows), commands: [], triggers: [], jobs, issue_history: backlogHistory(jobs, []), work_records: workRecords(jobs, []), csrf_token: csrf,
           infrastructure: { host, controller: { connected: !queue.closing }, workers: [{ id: 'local-executor', name: 'Local worker', host: host.hostname, connected: !queue.closing }] },
           automations: [], automation_control: definitions.automations, issue_provider: providerInfo(provider),
           delivery_configuration: deliveryProviderInfo(configAt(state), deliveryAdapter),
@@ -106,7 +106,7 @@ export function createController(state, adapter = executors(state), integrations
           const result = provider.supported ? await provider.list(page, state) : {repository:provider.repository, issues:[],next_page:null};
           const jobs = queue.all(), issues = result.issues.map(issue => associateIssue(issue, jobs, readinessMapping(config.issueReadinessLabels)));
           return send(200, { ...result, issues, provider:providerInfo(provider), page, state, loaded_count:issues.length, total:null,
-            history:backlogHistory(jobs, issues) });
+            history:backlogHistory(jobs, issues), work_records:workRecords(jobs, issues) });
         }
         catch (error) { throw new QueueError(error.message, error.status || 400); }
       }