feat(app): display decision snapshot replay details

[Crystora]

Summary

• Add an inspection-only decision snapshot replay view in the control panel (Agent runs → run detail) that surfaces a snapshot's public-safe provenance: confidence, freshness, evidence sources, scoring model, repo-signal snapshot ids, and explicit evidence gaps.
• Render counterfactuals ("why not the alternatives") behind an Authenticated ⇄ Public-safe audience toggle — private reason/facts/assumptions are shown only to authenticated viewers and withheld (with an explicit notice) in the public-safe view.
• Represent missing, stale, and incomplete evidence explicitly (status pill + caveats) instead of silently omitting it; fail closed on malformed snapshots.
• Add a pure, standalone view-model builder (buildSnapshotReplayView) with focused unit tests for populated / stale / missing / private states. No schema, API/OpenAPI, or migration changes.

Closes #285

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; global coverage stays at or above 97% for lines, statements, functions, and branches (aim for 98%+ branch coverage locally so CI variance does not fail near the threshold)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

npm run test:ci passes end to end. Coverage (src/** scope): statements 99.07%, branches 97.05%, functions 98.52%, lines 99.71% (all ≥ 97%). npm audit reports 0 vulnerabilities. The new view-model is unit-tested by test/unit/snapshot-replay-ui.test.ts (8 tests: populated, stale, missing, missing-provenance, authenticated counterfactuals, public-safe withholding with a leakage assertion, target filtering, and defensive parsing). Note: apps/** is outside the src/** coverage scope, so these UI additions do not affect the global coverage gate.

If any required check was skipped, explain why:

• None. The full npm run test:ci gate was run locally and passed.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics. The public-safe view withholds private counterfactual reason/facts/assumptions; provenance exposes only structured identifiers, enums, and timestamps. A unit test asserts the serialized public view excludes the private detail.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. N/A — no auth/cookie/CORS/GitHub App/Cloudflare/session changes.
• API/OpenAPI/MCP behavior is updated and tested where needed. N/A — read-only UI that consumes the existing freeform agent-run action payload (snapshot provenance from feat(agent): add decision snapshot provenance fields #282, counterfactuals from feat(agent): add counterfactual reasons to decision snapshots #361); no contract change (ui:openapi:check clean).
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. The panel builds replays from live /v1/agent/runs data; missing/stale states are derived from real evidence, with no mock/demo fallback.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. N/A — no docs/changelog changes.

UI Evidence

Agent runs → run detail → Snapshot replay. The audience toggle switches between the authenticated and public-safe views; private counterfactual detail is shown only when authenticated and withheld for the public-safe view.

State / title	JPG/PNG evidence
Authenticated (loaded) — full provenance + private counterfactuals, with toggle
Public-safe — private counterfactual detail withheld
Stale evidence — explicit caveats
Missing evidence

Notes

• No DB migration and no schema/OpenAPI change: provenance comes from the recommendation snapshot envelope (added in feat(agent): add decision snapshot provenance fields #282) and counterfactuals from the existing context-snapshot payload (feat(agent): add counterfactual reasons to decision snapshots #361); the view derives everything client-side and renders inline in the existing Agent runs detail.
• Inspection-only by design — no issue filing, PR creation, comments, labels, closure, or merge actions are added (per the issue's scope).
• Public/private separation is structural: the raw private evidence stays in the action payload and is never copied into the public-safe view; the audience toggle switches between two precomputed views and never re-derives withheld fields.
• Files changed (4, +737): apps/gittensory-ui/src/lib/snapshot-replay.ts (view-model + tests target), apps/gittensory-ui/src/components/site/snapshot-replay.tsx (SnapshotReplay + SnapshotReplayCard toggle), apps/gittensory-ui/src/routes/app.runs.tsx (wires it into run detail), test/unit/snapshot-replay-ui.test.ts.

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#482 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[JSONbored]

@bittoby this is good to land.

A few notes:

• The snapshot replay is wired into the real Agent runs detail surface.
• Public-safe vs authenticated views are structurally separated.
• Tests cover stale/missing/private states and public leakage.
• The evidence formatting is not ideal, but the required screenshots are present.
• No code changes requested.