code-coordinator 0.5.568__tar.gz → 0.5.570__tar.gz

{code_coordinator-0.5.568 → code_coordinator-0.5.570}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.568
+Version: 0.5.570
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.568 → code_coordinator-0.5.570}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.568
+Version: 0.5.570
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.568 → code_coordinator-0.5.570}/code_coordinator.egg-info/SOURCES.txt

@@ -812,6 +812,7 @@ tests/test_repo_edit_2220.py
 tests/test_repo_graph_fleet_2237.py
 tests/test_repo_max_parallel_3423.py
 tests/test_repo_onboard_2220.py
+tests/test_report_public_export.py
 tests/test_report_result_push.py
 tests/test_reports.py
 tests/test_restart_cmd.py

{code_coordinator-0.5.568 → code_coordinator-0.5.570}/code_coordinator.egg-info/scm_file_list.json

@@ -839,6 +839,7 @@
     "tests/test_repo_graph_fleet_2237.py",
     "tests/test_repo_max_parallel_3423.py",
     "tests/test_repo_onboard_2220.py",
+    "tests/test_report_public_export.py",
     "tests/test_report_result_push.py",
     "tests/test_reports.py",
     "tests/test_restart_cmd.py",

code_coordinator-0.5.570/code_coordinator.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "0.5.570",
+  "distance": 0,
+  "node": "g29bd794d5c1bbedb62f22cdd0bef36e1a1cddd33",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-10-03"
+}

{code_coordinator-0.5.568 → code_coordinator-0.5.570}/coord/commands/drive_queue.py

@@ -485,6 +485,7 @@ def drive_queue_add(
     # kind is happening on that path. Merging (or fixing forward) a
     # discovered PR is deliberately left to the operator — see
     # `existing_pr_relaunch_remedy`'s own docstring.
+    existing_pr_resume_note = ""
     if previous is None or previous.state in STUCK_QUEUE_STATES:
         existing_match = _existing_pr_match(config_path, repo, issue)
         existing_remedy = existing_pr_relaunch_remedy(repo, issue, existing_match)
@@ -494,6 +495,24 @@ def drive_queue_add(
                 f"{existing_remedy['what_happens']} Run instead: "
                 f"{existing_remedy['command_or_action']}"
             )
+        # #3539: `existing_remedy is None` with a real *existing_match* is
+        # ambiguous on its own — "no PR found, start fresh" and "PR found,
+        # green, but still missing a gate — resume on it" both return
+        # `None` from `existing_pr_relaunch_remedy` (see its docstring).
+        # Say which one happened: silently queuing a resume with no echo
+        # at all would read identically to a fresh `add` and hide the exact
+        # trap #3539 reports (an operator with no way to tell this add is
+        # about to drive the SAME branch, not a new one).
+        if existing_match is not None and existing_match.missing_gates:
+            gates_list = " and ".join(existing_match.missing_gates)
+            existing_pr_resume_note = (
+                f"\nresuming on existing PR #{existing_match.number} "
+                f"({existing_match.branch}) — CI is green but {gates_list} "
+                f"{'gate is' if len(existing_match.missing_gates) == 1 else 'gates are'} "
+                "not yet recorded; this add will dispatch only the missing "
+                f"stage(s) on that branch, never a new Work leg (coord "
+                f"gates {repo} {issue} shows the live detail)."
+            )
 
     # #2247: predicted file overlap ORDERS, never refuses. Anything that goes
     # wrong in here (unreadable body, unreachable board, a failed compare)
@@ -645,6 +664,7 @@ def drive_queue_add(
     click.echo(
         f"queued {entry_key(repo, issue)}{pinned}{suffix}{gate}{fix_rounds_note}"
         f"{no_acceptance_note}{scope_downgrade_warning}{overlap_note}"
+        f"{existing_pr_resume_note}"
     )
 
     # #2339: say out loud when this add cannot possibly accomplish anything —
@@ -951,15 +971,32 @@ def _existing_pr_match(
     answer than `coord.merge_queue.plan()`'s own `PLAN_READY` verdict — it
     reads raw `failed_checks`/`in_flight_checks` only and does not account
     for `merge_queue._ci_checks_are_stale` (a green check that silently
-    outlived a base move), review state, or any other merge gate. The
-    issue's own design accepted either condition ("all green OR `coord merge
-    --plan` reads READY"), and `coord merge --only` re-runs its own full gate
-    check before actually merging either way, so the worst case from the gap
-    is a confusing round trip (recommended here, still BLOCKED there), never
-    an incorrect merge. Wiring the fuller verdict in would need this call
-    site to assemble `plan()`'s board/GhOps/smoke-verdict inputs for a
-    single PR lookup — a bigger, riskier change than this fix-round's scope;
-    left as a known gap rather than attempted half-wired.
+    outlived a base move). The issue's own design accepted either condition
+    ("all green OR `coord merge --plan` reads READY"), and `coord merge
+    --only` re-runs its own full gate check before actually merging either
+    way, so the worst case from the gap is a confusing round trip
+    (recommended here, still BLOCKED there), never an incorrect merge.
+    Wiring the fuller verdict in would need this call site to assemble
+    `plan()`'s board/GhOps/smoke-verdict inputs for a single PR lookup — a
+    bigger, riskier change than this fix-round's scope; left as a known gap
+    rather than attempted half-wired.
+
+    `missing_gates` (#3539), unlike `all_green`, DOES reuse the real gate
+    decision — `coord.gates.build_gate_report`, the exact function `coord
+    gates` prints and that wraps `coord.merge_queue`'s own
+    `requires_review`/`scan_approved_reviews`/`requires_smoke`/
+    `evaluate_smoke_verdict` — rather than a second guess, closing the
+    quadraui#1109 gap: a PR can be all-green on CI while `coord gates`
+    still reports `review`/`test` BLOCKED, and the #2377 guard's old
+    "merge it" advice for an all-green PR was then impossible (`coord merge
+    --only` itself refused with `enqueue blocked by review gate`). Only
+    computed when `all_green` — a red PR's gate state is moot, the caller
+    refuses on CI alone either way. Fails open toward "missing" (NEVER
+    toward "satisfied"): an unreadable board/config, or a PR whose work
+    chain `build_gate_report` can't resolve a decision for, reports every
+    gate as still missing rather than claiming a merge is ready when a live
+    `coord merge --only` might still refuse it (#2096: unconfirmed success
+    is a defect).
     """
     coordinates = _repo_coordinates(config_path, repo)
     if coordinates is None:
@@ -990,14 +1027,64 @@ def _existing_pr_match(
         # reported", which `all_green` below already reads as not-green.
         checks = []
     all_green = bool(checks) and not failed_checks(checks) and not in_flight_checks(checks)
+    missing_gates = _missing_required_gates(config_path, repo, issue) if all_green else ()
     return ExistingPrMatch(
         number=number,
         branch=str(pr.get("headRefName") or ""),
         url=str(pr.get("url") or ""),
         all_green=all_green,
+        missing_gates=missing_gates,
     )
 
 
+def _missing_required_gates(config_path: Path, repo: str, issue: int) -> tuple[str, ...]:
+    """#3539: which of ``("review", "test")`` are still required-but-not-ok
+    for *repo*#*issue*, per `coord.gates.build_gate_report` — the SAME
+    review/test decision `coord gates` prints and `coord merge` itself
+    gates on (#2096: one question, one answer; never a second, driftable
+    guess at "is this PR actually ready").
+
+    Fails open toward "missing", never toward "satisfied": any read failure
+    (unreadable config, no board, an exception inside `build_gate_report`
+    itself) or a report with no resolved decisions at all (no work-like
+    assignment `build_gate_report` could select a winner from) reports
+    BOTH gates missing. A false "missing" here costs one operator-visible
+    resume note on an add that may turn out to be a no-op once the real
+    gates are read live again a moment later; a false "satisfied" would
+    reproduce the exact #3539 incident — advising ``coord merge --only``
+    over a PR a live merge attempt still refuses.
+
+    The board comes from ``coord.board_service.read_board()``, NOT
+    ``coord.state.build_board()`` (#615/#906): `coord drive-queue add` has
+    no whole-command daemon reroute, so a thin client reading the local DB
+    here would see an empty board, resolve no decisions, and fail open to
+    "both gates missing" on every add — technically safe, uselessly noisy.
+    `read_board()` is the one place the local-vs-daemon decision is made
+    (GET /board on a thin client, the local DB otherwise), which is also
+    why no entry is needed in `tests/test_thin_client_board_audit.py`'s
+    ``COMMANDS_ALLOWLIST``: there is no direct local-board call site to
+    allowlist.
+    """
+    try:
+        from coord import github_ops  # noqa: PLC0415
+        from coord.board_service import read_board  # noqa: PLC0415
+        from coord.commands._common import _load_config  # noqa: PLC0415
+        from coord.gates import build_gate_report  # noqa: PLC0415
+
+        cfg = _load_config(config_path)
+        board = read_board()
+        report = build_gate_report(board, cfg, repo, issue, gh_ops=github_ops)
+    except (Exception, SystemExit):  # noqa: BLE001 — fail-open to "missing"
+        return ("review", "test")
+    by_gate = {d.gate: d for d in report.decisions}
+    missing = []
+    for gate in ("review", "test"):
+        decision = by_gate.get(gate)
+        if decision is None or (decision.required and not decision.ok):
+            missing.append(gate)
+    return tuple(missing)
+
+
 def _predict_overlap(
     config_path: Path, repo: str, issue: int, existing_entries: list[QueueEntry],
 ) -> tuple[Prediction, str, str]:
@@ -6433,6 +6520,17 @@ def _blocked_escalation_command(
     behaviour) purely so every OTHER existing caller/test of this function
     that has no config to hand keeps working unchanged; the real `tick`
     call sites below always pass their own.
+
+    #3539: `existing_pr_relaunch_remedy` returning ``None`` is no longer
+    proof that *match* itself is ``None`` — a green PR with Test and/or
+    Review never recorded ALSO returns ``None`` (see that function's own
+    docstring), on purpose, so a plain `add` can resume on it. That case
+    still HAS a PR and HAS been dispatched, so it must not fall through to
+    `_requeue_command`'s blind ``remove && add`` either — remove would
+    discard a completed, green work cycle for no reason. Propose the plain
+    `add` (no `remove` first) instead; `_requeue_command` stays reserved for
+    the one case its own docstring names: *match* itself is ``None``,
+    i.e. nothing was ever dispatched for this row at all.
     """
     if is_merge_gate_block_reason(reason):
         parsed = parse_key(key)
@@ -6446,6 +6544,10 @@ def _blocked_escalation_command(
             remedy = existing_pr_relaunch_remedy(repo, issue, match)
             if remedy is not None:
                 return remedy["command_or_action"]
+            if match is not None:
+                # #3539: green PR, gate(s) not yet recorded — resume via a
+                # plain `add`, never the blind `remove && add` requeue below.
+                return f"coord drive-queue add {repo} {issue}"
     return _requeue_command(entry, key)
 
 

{code_coordinator-0.5.568 → code_coordinator-0.5.570}/coord/commands/report.py

@@ -26,10 +26,34 @@ why ``started_at`` exports as an epoch (or a real Excel datetime cell for
 extra rather than a crash.  ``--json`` survives as a hidden alias for
 ``--format json``.
 
+``coord report export <id> --public`` (#3474) runs a report the same way
+``report run`` does (``coord.state.run_report`` — daemon when
+``board_service`` is set, local registry otherwise) and then redacts it for
+an audience OUTSIDE the fleet, via :func:`coord.reports.redact_report_for_public`:
+every repo not named in ``coordinator.yml``'s ``reporting.public.allowlist_
+repos`` is dropped and folded into one aggregate ``"private repo"`` row —
+no name, no issue number, no title. The result is written as a
+self-contained ``.public.html`` (data inlined, chart on a pinned ECharts
+CDN) plus the same redacted ``.public.csv`` into ``--out`` (default: the
+current directory). A report whose dollar figure has no stated cost basis
+left standing after redaction is refused outright (``PublicExportError``) —
+"a public number with no stated basis is not produced" (#3474). The
+redaction itself runs **client-side**, over the already-fetched result —
+same precedent as every ``--format`` above, which also serialises
+client-side over ``run_report``'s own return value — so a thin client never
+needs a second, DB-backed export path. The allowlist that drives it,
+though, is resolved via :func:`_resolve_public_allowlist` — the same
+thin-client-first ``board_service``/``fetch_remote_config`` seam
+``coord.commands._common._load_config`` uses for every other config read
+(#1080/#947/#2824), never a raw local ``coordinator.yml`` load: the
+allowlist is the one input here that is explicitly security-sensitive, so
+a thin client with a stale local copy must never under-redact against it.
+
 Exit codes: ``2`` for a bad request (unknown report, unknown parameter, bad
-value, or ``--format xlsx`` without the extra installed — the message names
-what was allowed/needed), ``1`` for a read/transport failure.  Never a
-traceback for either.
+value, ``--format xlsx`` without the extra installed, or a public export
+refused over an unstated cost basis — the message names what was
+allowed/needed), ``1`` for a read/transport failure.  Never a traceback for
+either.
 """
 
 from __future__ import annotations
@@ -43,6 +67,36 @@ import click
 
 from coord.commands._common import _CONFIG_OPTION
 
+
+def _resolve_public_allowlist(config_path) -> frozenset[str]:  # noqa: ANN001
+    """The thin-client-safe ``reporting.public.allowlist_repos`` for
+    ``coord report export --public`` (#3474 review).
+
+    Mirrors :func:`coord.commands._common._load_config`'s "thin client
+    first" resolution — a machine with ``board_service``/``client.toml``
+    configured fetches the DAEMON's live config (``fetch_remote_config``)
+    rather than trusting whatever ``coordinator.yml`` happens to sit on
+    local disk, the exact bug class #1080/#947/#2824 already paid for
+    (a stale/stray local file silently diverging from the daemon's real
+    config with no signal anything is wrong). ``_load_config`` itself
+    ``sys.exit(2)``s on a bad config, which is right for every OTHER
+    command but wrong here: the allowlist is the one input this feature
+    treats as security-sensitive, so a failure to resolve it (daemon
+    unreachable, local file malformed/absent) must fail SOFT — the caller
+    catches whatever this raises and falls back to the empty allowlist,
+    i.e. "redact everything" (same posture as the daemon-side sibling,
+    :func:`coord.reports.load_public_allowlist`).
+    """
+    from coord.client import fetch_remote_config, resolve_board_service  # noqa: PLC0415
+    from coord.config import load as load_config  # noqa: PLC0415
+
+    path = config_path
+    svc = resolve_board_service()
+    if svc is not None:
+        path = fetch_remote_config(svc)
+    return frozenset(load_config(path).reporting.public.allowlist_repos)
+
+
 # Row keys whose values are epoch timestamps — rendered as a relative age in
 # the human table (absolute in --json, which is the machine contract).
 # Fallback only: used when a row column is not covered by the report's
@@ -372,3 +426,120 @@ def report_run(
         click.echo(f"notes ({len(notes)}):")
         for note in notes:
             click.echo(f"  • {note}")
+
+
+@report_group.command(
+    "export",
+    help="Export a report for sharing outside the fleet (#3474; --public is required today).",
+)
+@click.argument("report_id")
+@click.option(
+    "--param", "raw_params", multiple=True, metavar="KEY=VALUE",
+    help="Report parameter, repeatable (e.g. --param since=13h).",
+)
+@click.option(
+    "--public", is_flag=True, default=False,
+    help=(
+        "Redact every repo not in coordinator.yml's "
+        "reporting.public.allowlist_repos before exporting — everything "
+        "else is aggregated into one 'private repo' row with no name, "
+        "issue number or title. The only export mode supported today; "
+        "omitting this flag is a usage error rather than silently "
+        "producing an un-redacted export."
+    ),
+)
+@click.option(
+    "--out", "out_dir", type=click.Path(path_type=Path), default=Path("."),
+    show_default=True,
+    help="Directory to write the exported <report>.public.html/.csv pair into.",
+)
+@_CONFIG_OPTION
+def report_export(
+    report_id: str,
+    raw_params: tuple[str, ...],
+    public: bool,
+    out_dir: Path,
+    config_path: Path,
+) -> None:
+    if not public:
+        click.echo(
+            "error: `coord report export` needs --public today — a "
+            "self-contained, redacted HTML+CSV pair for sharing outside the "
+            "fleet (#3474). There is no un-redacted export mode.",
+            err=True,
+        )
+        raise SystemExit(2)
+
+    from coord.reports import (  # noqa: PLC0415
+        REPORTS,
+        PublicExportError,
+        assert_public_export_allowed,
+        public_csv_filename,
+        public_html_filename,
+        redact_report_for_public,
+        result_to_csv,
+        result_to_public_html,
+    )
+    from coord.state import run_report  # noqa: PLC0415
+
+    params: dict[str, str] = {}
+    for raw in raw_params:
+        if "=" not in raw:
+            click.echo(
+                f"error: --param expects KEY=VALUE, got {raw!r} "
+                "(e.g. --param since=13h)",
+                err=True,
+            )
+            raise SystemExit(2)
+        key, _, value = raw.partition("=")
+        params[key.strip()] = value
+
+    try:
+        result = run_report(report_id, params)
+    except ValueError as e:
+        # ReportError (local) or the daemon's 400/404 body, re-raised as a
+        # ValueError by coord.client.fetch_report — mirrors `report run`.
+        click.echo(f"error: {e}", err=True)
+        raise SystemExit(2) from e
+    except Exception as e:  # noqa: BLE001 — transport/DB failure
+        click.echo(f"error: report run failed: {e}", err=True)
+        raise SystemExit(1) from e
+
+    # #3474: redaction runs HERE, client-side, over the already-fetched
+    # `result` — same precedent `--format csv|xlsx|...` above already sets
+    # (those also serialise client-side over `run_report`'s own return
+    # value), so a thin client never needs a second, DB-backed export path.
+    # The allowlist itself goes through `_resolve_public_allowlist` — the
+    # SAME thin-client-first resolution every other config read uses
+    # (#1080/#947/#2824), not a raw local-file load — so a thin client whose
+    # daemon has since tightened `reporting.public.allowlist_repos` can
+    # never under-redact from a stale local copy. Any failure to resolve it
+    # (daemon unreachable, local file malformed/absent — reports need no
+    # config at all for `list`/`run`) is NOT a usage error here: it falls
+    # back to the empty allowlist, i.e. redact everything, the only safe
+    # default for an export leaving the fleet.
+    try:
+        allowed = _resolve_public_allowlist(config_path)
+    except Exception as e:  # noqa: BLE001 — fail CLOSED: unreadable/unreachable config => redact everything
+        click.echo(
+            f"warning: could not resolve reporting.public.allowlist_repos "
+            f"({e}) — redacting every repo.",
+            err=True,
+        )
+        allowed = frozenset()
+
+    report_def = REPORTS.get(report_id)
+    redacted = redact_report_for_public(result, allowed_repos=allowed, report=report_def)
+    try:
+        assert_public_export_allowed(redacted, report_id)
+    except PublicExportError as e:
+        click.echo(f"error: {e}", err=True)
+        raise SystemExit(2) from e
+
+    out_dir.mkdir(parents=True, exist_ok=True)
+    html_path = out_dir / public_html_filename(redacted)
+    csv_path = out_dir / public_csv_filename(redacted)
+    html_path.write_text(result_to_public_html(redacted), encoding="utf-8")
+    csv_path.write_text(result_to_csv(redacted), encoding="utf-8")
+    click.echo(f"wrote {html_path}")
+    click.echo(f"wrote {csv_path}")

{code_coordinator-0.5.568 → code_coordinator-0.5.570}/coord/config.py

@@ -1956,6 +1956,29 @@ class PricingConfig:
 COST_BASIS_CHOICES = ("api_equivalent", "billed")
 
 
+@dataclass
+class PublicReportingConfig:
+    """``reporting.public:`` block (#3474) — the redaction policy for a
+    report export meant to leave the fleet (``coord report export
+    --public``, the dashboard's ``/reports`` "Share" button).
+
+    A public export is for an audience that must never see a private repo's
+    name, issue titles or numbers — someone evaluating the tool, or
+    marketing material quoting "cost per merged issue". ``allowlist_repos``
+    is the only field: the coord-local repo names (as declared under
+    ``coordinator.yml``'s ``repos:``) that MAY be named verbatim in a public
+    export. Every row about any other repo is redacted — aggregated into a
+    single ``"private repo"`` row with no issue number, no title, and no
+    repo name of its own (:func:`coord.reports.redact_report_for_public`).
+
+    Default is empty, i.e. **redact everything** — the safe default for a
+    config that predates this block, or one that simply never opted a repo
+    in.
+    """
+
+    allowlist_repos: tuple[str, ...] = ()
+
+
 @dataclass
 class ReportingConfig:
     """``reporting:`` block (#3471) — what a cost-bearing report's dollar
@@ -1980,9 +2003,13 @@ class ReportingConfig:
     and the figure is real money charged — set it only when that is
     actually true; this config does no verification of its own; it only
     labels, on every report, what the operator asserts here.
+
+    ``public`` (#3474) is the redaction policy for a report export that
+    leaves the fleet entirely — see :class:`PublicReportingConfig`.
     """
 
     cost_basis: str = "api_equivalent"
+    public: PublicReportingConfig = field(default_factory=PublicReportingConfig)
 
 
 @dataclass
@@ -5088,6 +5115,22 @@ def _parse_reporting(raw: Any) -> ReportingConfig:
                 + ", ".join(COST_BASIS_CHOICES)
             )
         cfg.cost_basis = value
+    if "public" in raw:
+        public_raw = raw["public"]
+        if public_raw is None:
+            public_raw = {}
+        if not isinstance(public_raw, dict):
+            raise ConfigError("'reporting.public' must be a mapping")
+        allowlist = public_raw.get("allowlist_repos", [])
+        if allowlist is None:
+            allowlist = []
+        if not isinstance(allowlist, list) or not all(
+            isinstance(x, str) for x in allowlist
+        ):
+            raise ConfigError(
+                "reporting.public.allowlist_repos must be a list of repo names"
+            )
+        cfg.public = PublicReportingConfig(allowlist_repos=tuple(allowlist))
     return cfg
 
 

{code_coordinator-0.5.568 → code_coordinator-0.5.570}/coord/dashboard/server.py

@@ -1820,6 +1820,59 @@ def openapi_spec() -> dict:
                 },
             }
         },
+        "/api/report/{report_id}/public": {
+            "get": {
+                "summary": (
+                    "#3474: a redacted, self-contained export of a report "
+                    "for sharing OUTSIDE the fleet. Every repo not in "
+                    "coordinator.yml's reporting.public.allowlist_repos is "
+                    "aggregated into one 'private repo' row — no name, "
+                    "issue number or title. Refused with 400 when the "
+                    "report carries a cost figure but no cost-basis/"
+                    "coverage note survives redaction."
+                ),
+                "parameters": [
+                    _dashboard_path_param("report_id", "report id from the catalogue"),
+                    {
+                        "name": "format",
+                        "in": "query",
+                        "required": False,
+                        "schema": {"type": "string", "enum": ["html", "csv"]},
+                        "description": (
+                            "Absent/`html` returns a self-contained static "
+                            "page (data inlined; a declared chart renders "
+                            "via a pinned ECharts CDN script). `csv` "
+                            "returns the identical redacted rows as "
+                            "text/csv. Both ship a Content-Disposition "
+                            "filename."
+                        ),
+                    },
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "text/html": {
+                                "schema": {"type": "string"},
+                                "description": "`?format=html` (default).",
+                            },
+                            "text/csv": {
+                                "schema": {"type": "string"},
+                                "description": "`?format=csv`.",
+                            },
+                        },
+                    },
+                    "400": {
+                        "description": (
+                            "Unknown parameter / bad parameter value / "
+                            "unknown format / an unstated cost basis "
+                            "refused the export"
+                        )
+                    },
+                    "404": {"description": "Unknown report id"},
+                },
+            }
+        },
         "/api/approve": {
             "post": {
                 "summary": "Dispatch one or more proposals by id",
@@ -3721,6 +3774,82 @@ def build_app(
             result.to_dict() if isinstance(result, _reports.ReportResult) else result
         )
 
+    async def api_report_export_public(request: Request) -> Response:
+        """GET /api/report/{report_id}/public?format=html|csv&... — a
+        redacted, self-contained export for sharing OUTSIDE the fleet
+        (#3474): the dashboard's ``/reports`` "Share" affordance and
+        ``coord report export --public`` both end up describing the exact
+        same redaction, since both go through
+        ``coord.reports.redact_report_for_public`` — never a second,
+        independently-drifting idea of what "public" means (#2096).
+
+        ``format`` defaults to ``html`` (the self-contained page: data
+        inlined, chart — if any — on a pinned ECharts CDN); ``csv`` returns
+        the identical redacted rows as a download. Every repo not in the
+        loaded ``coordinator.yml``'s ``reporting.public.allowlist_repos``
+        is aggregated into one ``"private repo"`` row with no name, issue
+        number or title. A cost-bearing report whose basis/coverage note
+        did not survive redaction is refused with 400 — "a public number
+        with no stated basis is not produced" (#3474).
+        """
+        from starlette.concurrency import run_in_threadpool  # noqa: PLC0415
+
+        from coord import reports as _reports  # noqa: PLC0415
+
+        report_id = request.path_params["report_id"]
+        params = dict(request.query_params)
+        fmt = (params.pop("format", "") or "html").strip().lower()
+        if fmt not in ("html", "csv"):
+            return JSONResponse(
+                {"error": f"unknown public export format {fmt!r} — allowed values: html, csv"},
+                status_code=400,
+            )
+        try:
+            if _fixture is not None:
+                raw_result = _fixture.report_result(report_id, params)
+            else:
+                raw_result = await run_in_threadpool(_reports.run_report, report_id, params)
+        except _reports.UnknownReportError as e:
+            return JSONResponse({"error": str(e)}, status_code=404)
+        except _reports.ReportError as e:
+            return JSONResponse({"error": str(e)}, status_code=400)
+        except Exception as e:  # noqa: BLE001 — surface a clean 503 rather than a stack trace
+            return JSONResponse(
+                {"error": "report run failed", "detail": str(e)}, status_code=503
+            )
+
+        report_def = _reports.REPORTS.get(report_id)
+        # The app's own bound `config` (fixture or live — see `build_app`'s
+        # own docstring), never a second, independent `coordinator.yml`
+        # read off disk: fixture mode's "every read is answered from the
+        # fixture" promise has to hold for the redaction policy too, not
+        # just the report data being redacted.
+        allowed = frozenset(config.reporting.public.allowlist_repos)
+        redacted = await run_in_threadpool(
+            _reports.redact_report_for_public,
+            raw_result,
+            allowed_repos=allowed,
+            report=report_def,
+        )
+        try:
+            _reports.assert_public_export_allowed(redacted, report_id)
+        except _reports.PublicExportError as e:
+            return JSONResponse({"error": str(e)}, status_code=400)
+
+        if fmt == "csv":
+            body = await run_in_threadpool(_reports.result_to_csv, redacted)
+            filename = _reports.public_csv_filename(redacted)
+            media_type = "text/csv; charset=utf-8"
+        else:
+            body = await run_in_threadpool(_reports.result_to_public_html, redacted)
+            filename = _reports.public_html_filename(redacted)
+            media_type = "text/html; charset=utf-8"
+        return Response(
+            body,
+            media_type=media_type,
+            headers={"Content-Disposition": f'attachment; filename="{filename}"'},
+        )
+
     async def api_approve(request: Request) -> JSONResponse:
         from coord.dispatch import (
             apply_liveness_reroute,
@@ -5666,6 +5795,11 @@ def build_app(
         Route("/api/drive-queue/action", api_drive_queue_action, methods=["POST"]),
         Route("/api/report", api_report_catalogue, methods=["GET"]),
         Route("/api/report/{report_id}", api_report_run, methods=["GET"]),
+        Route(
+            "/api/report/{report_id}/public",
+            api_report_export_public,
+            methods=["GET"],
+        ),
         Route("/api/approve", api_approve, methods=["POST"]),
         Route("/api/reject", api_reject, methods=["POST"]),
         Route("/api/diff/{id}", api_diff, methods=["GET"]),